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1 Introductory remarks concerning transpoSltlon ciphers -a As stated ma prevtous text, 


transposition ciphers are roughly analogous to "Jigsaw puzzles" m that all the pieces of which 
the origmal is composed are present but are merely disarranged 
The pieces mto which the 
picture formmg the basis of a Jlgsaw puzzle may be divtded are usually qmte irregular m size 
and shape, the greater the amount of irregularity, as a rule, the greater the difficulty m rea.s- 
sembhng the pieces m proper order 
In this respect, too, transpoSition ciphers are analogous to 
Jlgsaw puzzles, for the greater the amount of dIStortion to which the plam text lS subJerted m 
the transposition process, the more difficult becomes the solution 


b In Jigsaw puzzles there is usually no regularity a.bout the size of the mdiv1dual pieces 


mto which the origmal picture has been cut, and this feature, of course, materially contubutes 
to the dllficulty m reconstructmg the picture 
There are, to be sure, llIDlts (dictated by con- 


Siderations of practicability) which serve to prevent the pieces bemg made too small, for then 
they would become unmanageable, on the other hand, there are also llIDlts which must be ob- 
served m respect to the upper magmtude of the pieces, for if they are made too large the puzzle 
becomes too easy to solve 
These features of Jigsaw puzzles also have their analogies m trans- 
position methods 
In the latter, if the textual units to be subJected to transposition are made 
qmte large, say entire sentences, the difficulties a cryptanalyst will have m reconstructmg the 
text are practically ml, on the other hand, if these textual umts me made quite small, even 
smaller than smgle letters, 1 then the reconstruction of the transposition text by a cryptanalyst 
often becomes a very difficult matter 
In between these two extremes there may be various 


degrees of fragmentation, limited only by considerations of practicability 
c It is fortunate, however, that the cryptanalyst does not, as a rule, have to contend with 


problems m which the size of the textual umts varies withm the same message, as is the case m 
Jigsaw puzzles 
It is perhaps possible to devise a transposition system m which the text is 
divided up m su<.,h a manner that entire sentences, whole words, syllables, mdividual letters, and 
fractions of letters form the units for transpoSition, but it is not difficult to rmagme how imprac- 
tical such a scheme would be for regular commumcation, and it may be taken for granted that 
such irregularity m size of te:i>.tual umts will not be encountered m practical commumcation 
d The days \\hen the S1IDple methods of word transposition were sufficient for military 


purposes have long smce passed by, and it IS hardly to be expected that cryptograms of such 
meffectual nature will be encountered m the military commumcations of even the smaller armies 
of today 
However, m time of emergency, when a counter-espionage censorship is exercISed over 
mternal commurucations, it is posSible that isolated mstances of simple word transposition may 
be encountered 
The solution of such cases should present no difficulties, unless numerous code 
names and nulls are also used m the cryptograms 
Mere experimentation with the cryptograms, 
trymg various types and sizes of rectangles, will usually dlSclose the secret text If code names 


1 Reference 18 here made to so-called fractionating systems 
See SpecJ.&l Text No 166, AdWJnced Military 
Cryptography, sec XI 
(1) 


2 


are used and the context g1ves no clue to the identity of the persons or places mentioned, it may 
be necessary to wait until add1t1onal messages become available, or, lacking such a poss1b1hty, 
there ts usually sufficient JUstificat1on, under the 0X1gencies of war, to compel the correspondents 
to reveal the meanmg of these code names 
e Although transposition ciphers, as a general rule, are much less complex m thc:tr mechamcs 


than a.re subst1tut1on ciphers, the cryptanalyst usually expenences a feel mg of distaste and 
dlSmay when confronted with unknown ciphers of this category 
There are several reasons for 


his d1Shke for them 
In the first place, although transpos1t1on ciphers are admittedly less mtncate 


than subst1tut1on ciphers, as a general rwe there are not nearly so many cryptanalytw tools and 
"tncks" to be used m the solution of the former as there are m the latter, and therefore the 
mental strmwus and satisfaction which the cryptanalyst usually denves and regards as part of the 
reward for his hard labor m solvmg a cipher is often rmssmg m the case of transpoSition ciphers 
In the second place, despite therr lack of complexity, the solution of transpos1t10n ciphers often 
mvolves a tremendous amount of time and labor most of which commonly turns out to be 
frwtless expenmentat1on 
Thirdly, m modern military commumcation, transpos1t1onmethods 


are usually not employed alone but m conJunction with substitution methods-and then the 
problems may become difficult mdeed, for usually before the subst1tut1on can be attacked it is 
necessary first to uncover the transposition 
Fmally, m workmg with transposition ciphers a 


much higher degree of accuracy m mere mechaD.Ical operations is requrred than m workmg with 
substitution ciphers, because the accidental omission or addition of a smgle letter will usually 
necesSltate rewntlng the work sheets applymg to entrre messages and starting afresh 
Thus, 


this sort of work calls for a constant state of concentrated attention, with its resulting state of 
psycholog1cal tenSlon, which takes its toll m mental wear and tear 
2 Basic mechamsm of transposition ciphers-a Basically,all transposition ciphers mvolve 
at least two processes (1) Wnting the plain-text umts (usually smgle letters) w1thm a specmc 
reglliar or irrPgular two-drmensional design called a "matnx," "cage," "frame," "rectangle," 
ef.c , m such a prearranged manner that the said umts are dIStnbuted regularly or irreglliarly 
throughout the vanous cells or subsections of that design, (2) removmg the plam-text umts 
from the design m such a prearranged manner as to change the ongmal sequence m which they 
followed one another m the plam text, thus producmg cipher text 
Smee the first process consists 


of mscnbmg the text withm the design, it IS techmcally referred to as the process of inscription, 
and Slllce the second process collSlsts of transcr1bmg the text from the design, it is techmcally 
referred to as that of transcription 
Either or both processes may be repet1t1ve, by prearrange- 


ment of course, m which case the mtermed1ate steps may be ref erred to as processes of rescription, 
or rescriptwe processes 
b It is hardly necessary at this pomt to g1ve the student any md1cations as to how to 


differentiate a transpo81t1on from a substitution cipher If a review is necessary, however, he 
is referred to Section IV of Military Cryptanalysis, Part I 
3. Ko:p.ophase and polyphase transposition -a As may be mf erred from the foregomg 


defimtions, when a transpos1t1on system mvolves but a smgle process of mscnpt1on, followed by 
a smgle process of transcnption, the system may be referred to as monopkase transposition, 
commonly called single transposition 
When one or more rescnptive processes mtervene between 
the ongmal lllScnption and the final tre.nscnpt1on the system may be ref erred to as polyphase 
transposition 
As a general rule, the solution of the latter type is much more difficult than the 
former, especially when the succesSlve transpo81tlons are theoretically correct m p1mc1ple 
b Any system which is swted for monophase transpo81t1on is also usually swted for polyphase 


transposition, the processes of lll8cnpt1on, rescnption and transcnpt1on bemg accomph~hed 
with the same or with different keys 


SECTION II 


SOLUTION OF SIMPLE TRANSPOSITION CIPHERS 
Paragraph 
Simple types of transpo'l1tion __ 
The prmciple~ of solution of umhteral route-tranopo-1t1011 c1pheri:. 
----- -- -------- -- -- -- -------- - ------ 
-- 
Keyed columnar tran'lpO'l1t1on ~1th completelv-fi.lled rectangles -- - - 
- - - ---- ----- ----- - - 
Example of solution _ 
------ _ _ ---- -- ------ -- _ ------- -- -- ----- ------------ ---------------- --------- - ------ ---· 


The probable-word method of solution _ _ __ ------------------- ----- ------------------------------------ ----- ----- 
General remarks on bOlution 
-------- ------------ --- ---------------------- ----------------------------- - - ---- - ---- --- 


Reconstruction of literal key 
-- 
-- ____ -- 
---------- -- _ ----------- ---- ----- ------------- ------ ------ ---- 


Column and row transposition - --- -- ----- 
-- --- -- ------- 
_ --- ----- -- - ----- -------- - -- -- -- ------ --- 
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4 Simple types of transposition -a The sunple cases of reversed wntmg, vertical wntmg, 
or rail fence wntmg hardly reqmre senous attention, smce they may be solved ahnost by mspec- 
t1on 
These methods are mcluded here only because they may be encountered m censorship 


operations 


b The low degree of cryptographic secunty afforded by these methods may be mcreased to 


a shght degree by addmg nulls or by disgmsmg the ongmal word lengths, and regroupmg mto 
false words or mto groups of regular length 


c Some examples of these simplest types of transposition follow 
Let the message be 
BRIDGE DESTROYED AT ELEVEN PM 


(1) Reversmg only the words and retammg ongmal word lengths 


Cipher___ E G D I R B D E Y 0 R T S E D T A N E V E L E 
M P 


(2) Reversmg only the words end regroupmg mto false word lengths 


Cipher__ E G D I R B D E Y 0 R T S E D T A N E V E L E M P 


(3) Reversmg the whole text and regroupmg mto fives 


Cipher ___ M P N E V E L E T A D E Y 0 R T S E D E 
G D I R B 
(4) Reversmg the whole text, regroupmg mto fives, and msertmg a null m every fifth position 
Cipher___ T R I M M 
P N E V P 
E L E T A A D E Y R 0 R T S L 
E D E G U D I R B M 
(5) Wntmg the text vertically m two columns and takmg the reswtmg 
digraphs for the cipher text, as shown at the side The cipher mes- 
sage becomes 


B S R T I 
B I G D S 
RDOGY EEDDE 
R Y D R D E E T 0 E 


, or 


B S 
RT 
I R 
D 0 
G y 
EE 
DD 
E 


BR 
ID 
GE 
DE 
ST 
R 0 
y E 
D 
These srmple types can be solved merely by mspect1on 


5. The pnnciples of solution of unihtera.l route-transposition ciphers-a The so-called 
umhteral route-transpos1t1on methods are next to be exammed 
The solution of cryptograms 
enciphered by these methods lS a matter of expenmentmg with geometnc figures, usually rec- 


(3) 


4 


angles, of various drmensions suggested by the total number of letters in the message, then 
nspectmg these rectangles, searching for whole word~ or the fragments of words by readmg 
honzontally, diagonally, vertically, spirally, and so on 1 
(See Special Text No 165, Elementary 


Mil'/Jary Cryptography, 1935, pars 20, 21) 
b The amount of experrmentation that must be performed m the solution of ciphers of this 


type may be matenally shortened by means of formulae and tables constructed for the purpose 
But because ciphers of thIS type are of mfrequent occurrence today, these formulae and tables 
are only occasionally useful and hence they have not been mcluded m this text 2 


6 Keyed columnar transposition with completely-filled rectangles -a In practical cryp- 


tography, the drmens1ons of the transpos1t1on rectangle, as a general rule, cannot vary between 
large lrmits, that IS, it can be assumed m practice that rectangles based upon Imes of wntmg 
contammg less than 5 letters or more than 25 letters will not commonly be encountered If the 
width, that is, the number of columns, is determmed by a key, then the number of rows becomes 
a function of the length of the message to be enciphered If the latter is very long, longer than 
can be convemently handled without too many errors, it is a common practice to break up a 
message mto two or more parts and treat each part as though it were a separate commumcabon 
Such parts are commonly termed sections 


b When the last row of a transposition rectangle IS completely filled, the solution of the 
resultmg cryptogram IS considerably more srmple than when this is not the case 8 Conse- 
quently, thIS wtll the constitute first case to be studied 


1 It is mterecitmg to observe that Damel, of Biblical fame, wao; apparently the first cryptanalyst m history 


(as well as one of the earhe'!t mterpreters of dreams), for he solved the cryptogram m the "handwr1tmg on the 
wall," obtammg as his decipherment words which he mterpreted as predictmg the downfall of Belshazzar and 
his dynastv (Damel V 1-28) 
The followmg partial account of the episode is not as enhghtemng as one might 


wish, but it is probably the best explanation available 
It is taken from Dr Max Sehgsohn's article on the sub· 


Ject m The Jewish Encyclopedia, vol fl, pp 490-491 (1925) "MENE, MENE, TEKEL, UPHARSIN crci1n i,pn Km IOD) 
Words written by a mystenous hand on the walls of Bel<Jhaz:rar's palace, and mterpreted by Dame] as predictmg 
the doom of the Kmg and his dynasty 
The mcident is described as follows Once when Kmg Bel'lhazzar was 
banquetmg with his lords and dnnkmg wme from the golden vessel'! of the temple of YB WH, a man's hand was 
seen wntmg on the wall certain mvstenous words 
Frightened bv the apparition, the Kmg ordered his astrol- 


ogers to explam the mscnption, but they were unable to read it 
Damel was then summoned to the Royal 


Palace, and the Kmg promISed hrm costly presents if he could decipher the mscription 
Damel read it "Mene, 


mene, tekel, upharsm," and explamed it to mean that God had "numbered" the Kmgdom of Bel'lhazzar and 
brought it to an end, that the Kmg had been weighed and found wantmg, and that his Kmgdom was divided 
and given to the Medes and Persians 


The first question which presents itself to the cntic, namely, why <'ould the mo;cription be deciphered by 
Damel onlv--engaged the attention of the TalmudISts, who advanced vanou'! an'!wers 
Certam of them 
concluded that the Hebrew writmg had been changed m the time of Ezra, so that even the Jews that were 
found m the royal court could not read an mscnpt10n wntten m archaic characters 
But those who follo\'1-ed 


R Simeon m mamtammg that thP wntmg had not changed found other solutions for the problem, e q 1t wa'! 
written m the crvptograph10 combmation 111:1 nic, eaoh letter of each pair bemg substituted bv its compamon 
e g tlDn 2i1 1,K ntl' ntl', or the words were written thu'I yii,n 'DPD l:IVlDD, one abovP the other, havmg to b~ 
read vertically, or 'lll"la'2 npi, Cl:llC cmc, each word backward, or agam, 1'1:1"1111 i,np acm ICDJ the first two letters of 
each word bemg transpo&ed {Sanh 22a) 
It 1s evident that the author of the Book of Damel meant that the 


mscnpt10n was written m characters fam1har to the Kmg and wise men of Babylon, but that, as often happens 
with ancient mscr1ptions, the transpos1t1on of certam letters baffled every attempt to decipher them 
" 
1 See Lohr, Lenox R and Fnedman, Wiiham F, Formulae for the solutwn of transposition ciphers 
Riverbank 
Pubbcat1on No 19, Geneva, lllmo1s, 1918 


1 See Special Text No 165, Elementary Military Cryptography, 1935, Sec V In this text the term "trans- 


pos1t1on rectangle" will be used to designate the matnx, frame, cage, or design regardless of whether the latter 
is completely filled or not 
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c In solvmg a cryptogram of this type the first step taken by the cryptanalyst is to ascerlam 


the drmens1ons of the rectangle 
Clues for this are usually afforded by findmg the factors of 
the total number of letters m the cryptogram 
Suppose the cryptogram contams 152 letters 
The drmens10ns of the transpos1t1on rectangle may be 4X38 or 8X19, by wlnch is meant that 
four hypotheses may be made with respect to its drmens1ons 
The rectangle may consist of 
(1) 4 columns with 38 rows, or 
(2) 38 columns with 4 rows, nr 
(3) 8 columns with 19 10wq1 01 
t4) 19 columns with 8 rows 
In practical work it is rather unlikely to encounter a rectangle that conforms to hypothesIS (1) 
or (2), and f01 the present these may be discarded 
As to choosmg between hypotheses (3) and 
(4), a rather simple test to be described presently will di.,clm.e which is the more probable 
d It is obvious that if the cryptogram is transcribed w1thm a rectangleofthecorrectdimen- 
s1ons the letters m each row will be the ones which actually were m those rows m the origmal 
, 
, 
transpos1t10n rectangle and formed good plam text therem 
In fact, the rows of letters in the 


correctly-dimennoned rect,angle would read p'lain text were 1t not for the transposition which they have 
undergone within the rows 
Therefore, the rows of a correctly-dimens10ned rectangle are more 
hkely to manifest the expected vowel-consonant proportions of normal plam text than are the 
rows of an mr01rectly-d1mensioned rectangle, because m the latter case there are brought mto 
some of the 10ws letters which belong to other rows and which are hkely to dISturb the normal 
vowel-consonant proport10ns of plam text 
That is, m an mcorrectly-dimensioned rectangle 
some of the rows will have too many consonants and not enough vowels, m other rows this 
relationslup will be reversed, whereas ma correctly-dimensioned rectangle each row will have the 
proper number of vowels and consonants 
Hence m solvmg an unknown cryptogram of this 


type, If a count i<1 made of the vowels and consonants m the rows of rectangles of various probable 
drmens10ns, that rectangle m. which the rows show the best proportions of vowels and consonants 


18 most likely to be correct, and the one that should be tried first 
e Havmg ascertamed the correct drmens10ns of the rectangle by the foregomg procedure, 
the next step is to expenment with the columns of the rectangle, trymg to brmg together several 
columns which wtll then show "good" digraphs, tngre.phs, or polygraphs m the rows formed by 
Juxtaposmg the columns 
This process of combmmg or matchmg columns m order to bmld up 
these fragments of plam text will heiem be referred to as anagramming' 


f The procedure is to select a column which has a good assortment of high-frequency letters 
and find another column which may be placed before or after the selected column to bmld up 
high-frequency digraphs m the rows, when such a pair of columns has been found, attempt is 
made to add another column before or after th1~ pair to bmld up high-frequency tngraphs, and 
so on, gradually butldmg up longer and longer polygraphs until entire words begm to appear m the 
respective rows of the rectangle 
In this process of anagrammmg, advantage may be taken 
of simple mathematical considerations such as adding the normal plam-textfrequency values of the 
digraphs m the rows to assist m discardmg combmat10ns whlCh are on the borderline of choice 
However, it must be noted that the totals obtamed by srmple addit10n of the frequency values of 


'The Standard D1ct1onary defines the \\Ord anagram as follows "(noun) 1 
The letters of a V'tord or phrase so 
transposed a<;; to make a different \\Ord or phra-;e, as, 'time' and 'mite' are anagrams of 'emit' 
2 
<\ tran<;;pos1t1on, 


mterchange" As a verb, 1t 11> defined as "to anagrammat1ze, to make an anagram of, make anagrams" 
(The 


construction of anagrams was a very \'l-1despread pastime m prev1ou<1 centunes 
See Wheatley's Of Anagrams, 


London, 1862) 
A strict mterpretation of the \\Ord would therefore confine 1t to cases wherem the letters to be 
rearranged already form bonafide words or mtelhgible phrases 
However, this \\ould hardlv be broad enough for 


crvptanalytic purposes 
As used m cryptanalysis the word 1s commonly employed as a verb to refertotheproc- 
ess of rearrangmg the disordered letters of cipher text so as to reconstruct the original plam te'\t 


6 


the digraphs should be considered only as rough approximations or gmdes in weighing probabil- 
ities m favor of one hypothesis as agamst another, for theoretically the probability of the srmul- 
taneous ocrurrenre of two or more independent E>vents 1s the product, and not the sum, of their 
respective probabilities 
In most rases the calculat10n of products involves an amount of labor 
unwarranted by the results to be expected, so that simple addition of probabiht1es i~ usually 


~ufficient 
However, if tables of the logarithms of the probabilities are readily available, the 


addition of these loganthms becomes a srmple matter and affords a more acrurate gmde m selec- 
t10n of combmations produced m the anagrammmg proces~ 5 Once a ~et of four or five column~ 
has been correctly assembled 1t 1~ u~ually the case that the process may be rompleted very qmrkly, 
for with the placement of earh rolumn the number of remainmg columns possible for selection 
drm1mshes, toward the close of the p1ocess, when only two or three columns remain, their plare- 
ment is almost automatic 


g It is desirable, as a final step, to try to reconstruct, if possible, the literal key from which 


the numencal transposition key was denved 
7 Example of solution -a Given the followmg cryptogram, the steps m solution will be 
set forth m detml 


IL H HD 
RHNEA 
RIV NL 
UP 0 LR 
R T G E T 


T I E 0 E 
TN NV U 
RNRWE 
S 0 M T N 
A 


CRYPTOGMM (126 letteii:.) 


U D H T S 
T L B F A 
T U T C U 
FRAN F 


0 N S 0 0 
E D F 0 Y 
V RAU 0 
MN D MA 


E E E E I 
C A P D T 
0 0 F D A 
S A F A T 


0 E F T R 
R R I I A 
0 N A J I 
YE CF X 


b The cryptogram contains 126 letters (factors of 126 2, 3, 6, 7, 9, 14, 18, 21), suggestmg 
rectangles of 7X 18 or 9X 14 
If the former dimensions are taken, the rectangle may have 7 
rolumns and l810ws or 18 rolumns and 7 rows, if the latter dimensions are taken, it may have 9 
rolumns and 14 iows or 14 columns and 9 rows 
The fartors of 126 do not, of course, preclude 
the possibility that the 1ectangle may be 6X21, that is, with 21 columns and 6 rows or 6 column., 
and 21 rows 
If no good results were obtained by testmg rectangles of the dimensions mdicated 
(7X18 or 9X14), then one would proceed to test rectangles 6X21 
In the event that all tests on 
the basis of a completely-filled rectangle failed, then it would be assumed that the rectangle mav 
be incompletely filled 
In making the vowel-consonant test described m paragraph 6d, it is 
advisable to base the count on the columns as well as on the rows of a rectangle, smce it is possible 
that the cryptogram was prepared by mscnbmg the plam text m rows and transcl'l.bIDg the text 
from the columns, or vice oersa 
After exammmg a rectangle both honzontally and vertically, 


it is often possible to discard vanous arrangements without further tests 
For example, at A 
m figure 1 there is shown a rectangle of 7 columns a.nd 18 rows 
Now m a row of 7 letters there 
should be (7X40 percent=2 8) either 2 or 3 vowels, but rows 12 and 15 contam no vowels at all 
and rows 8 and 9 contam 5 vowels, row 16, 6 vowels It 1s concluded a.t once that this arrange- 
ment 18 highly improbable If the plam text had been mscnbed vertically m this same rectangle, 
and then the rows had been transposed m forming the mpher text, then m each column (18 letters) 
there should be (18X40 percent=7 2) a.bout 7 vowels, but column 2 contams 11 vowels and col- 
umn 6 only 4 
This likewise md1cates that it is highly improbable that the message was mscnbed 


vertically wd the crvptogram formed by transposmg the rows 
But when the arrangement at 


1 A suggestion for which the author is indebted to Mr .\ W Small, Jumor crvptanah -.t m this office 
The 
pnnc1ple makes practtcahle the use of tabulatmg machmery for the purpose of <ipeedmg up and fac1htatmg tl>e 
matching of columns m the anagramrmng process 


7 


B m figure 1 is studied, it is not so easy to say at once that it is rmprobable 
For in 18 letters 
there should be about 7 vowels and none of the rows of th.is arrangement shows too great a 
departure from this expected number 
Th.is poss1bil1ty will have to be explored further and it 


1s for the moment put aside If it be assumed that the message was mscnbed vertically m the 
rectangle 18X7 and the rows subJected to transposition, there should be (7X40 percent=2 8) 
2 or 3 vowels 10 each column 
But smce several of the columns show rather considerable depar- 
tures from this expected number, it may be concluded that a vertical inscnphon and honzontal 
transcription 1s not probable and till& assumpt10n may be elrmmated 
Then the arrangement& 


at C and D m figure 1 are studied m the same manner, with the result that at the encl of the study 
the s1tuat1on as regards the vu.nous assumptions is summ8nzed as follows 


0 z 


~ 
1 
2 
3 
4 
5 
6 
7 
8 
9 


7 x 18 


1 
2 
3 
4 


2 
3 
4 
5 
6 
7 


8 


18 x 7 


I E S E T T B Y R N T A A P T M F X 
L 0 0 E R N F C I L U U 0 0 N N A R 
H E N E R N A A I R T 0 N L F D T T 
H U S I H V E P A N C 0 A R R M Y G 
DDOONUDDRRUOJSAAEE 
T H 0 E E T F T I W V F I 0 N S C T 
I T E F A L 0 R V E R D U M F A F A 


10 
11 
12 
13 
14 
15 
16 
17 
18 


I 0 N T T U M 
L 0 N R C P A 
H E V R U 0 S 
HEUIVLA 
DETIRRF 
TELAASA 
I I B R U 0 T 
E 0 F I 0 M Y 
0 E A V 0 T E 
E F E N 0 N C 
U T D L F F F 
D R F R D R X 
H R 0 N A A R 
T H Y R 0 N T 
S N C W N F G 
0 E A E A M E 
N A P T J N T 
S T D U I D A 


Number of} 
vowels 
--- 
2 
4 
4 
6 
2 
1 
3 
2 
4 
1 
2 
5 
5 
2 
1 
2 
3 
2 


Number of} 
7 11 
6 
6 
vowels 
-- 
10 
4 
7 


1 
2 
3 
4 
5 
6 
7 
8 
9 


10 
11 
12 
13 
14 


A 


9 x 14 


1 
2 
J 
4 
5 
6 


I S T B R T A T F 2 
L 0 R F I U 0 N A 5 
H N R A I T N F T 2 
H S H E A C A R Y 4 
D 0 N D R U J A E 4 
T 0 E F I V I N C 4 
I E A 0 V R U F F 5 
E E T Y N A P M X 4 
0 E N C L U 0 N R 4 
E E N A R 0 L D T 4 
U I V P N 0 R M G 3 
D 0 U D R 0 S A E 5 
H E T T W F 0 S T 2 
T F L R E D M A A 3 


Number of} 
6 
10 
J 
vowels 
- 
0 
5 
7 
7 
3 
5 
c 


B 


14 x 9 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 11 
12 13 14 


1 I E 0 F N E T N T 0 U N M C 
2 L U 0 T N D R L C F P F A F 
3 H D E R V F R R U D 0 R S X 
4 H H E R U 0 I N V A L A A R 
5 D T E H T Y I R R 0 R N F T 
6 T S E N L C A W A N S F A G 
7 I 0 I E B A R E U A 0 M T E 
8 E N 0 A F P I T 0 J M N Y T 
9 0 S E T A D V U 0 I T D E A 


Number of} 
vowels 
4 
3 
9 
2 
2 
4 
4 
2 553152 
D 


FIGURB l 


6 
3 
3 
7 
4 
4 


10 


6 
8 


9 


Rectangle 7 X 18 
7 columns and 18 rows 
{l) Horizontal mscription, columnar transcription _______________________ Very improbable 
(2) Vertical mscription, horizontal transcription__ 
_ _________________ Very improbable 
18 columns and 7 rows 
(3) Horizontal mscription, columnar transcription _____________________ Possible 
(4) Vertical mscription, horizontal transcription__ 
___ __ 
__ ------ _ Improbable 


Rectangle 9 X 14 
9 columns and 14 rows 
(5) Horizontal mscuption, columnar transcuption_ ____ 
_ ______ Possible 
(6) Vertical mscription, horizontal transcription__ 
_ ____________ --- Improbable 
14 columns and 9 rows 
(7) Horizontal mscription, columnar transcription 
__________ 
__ ------ Improbable 
(8) Vertical mscription, horizontal transcription____ _ _________________ Very rmprobable 


c Discardmg all assumptions except (3) and (5), the latter are subjected to further scrutmy 
Suppose the average amount of deviation from the expected number of vowels m each row is 
calculated by findmg the difference between the actual and expected numbers m each row, 
addmg these differences (neglectmg signs), and dividmg by the total number of rows 
For as- 
sumptions (3) and (5) the results are as follows 
., 
'"il 


~ .. 
c; 


1 
2 
3 


18 x 7 


9 
10 11 ~ U 14 M W " 
R i 
4 
5 
6 
7 
8 


I E S E T T B Y R N T A A P T M F X 
L 0 0 E R N F C I L U U 0 0 N N A R 
H E N E R N A A I R T 0 N L F D T T 
H U S I H V E P A N C 0 A R R M Y G 
D D 0 0 N U D D R R U 0 J S A A E E 
T H 0 E E T F T I W V F I 0 N S C T 
I T E F A L 0 R V E R D U M F A F A 


6 
9 
6 
7 
9 
6 
8 


~ .. 
all 
,g § 
== 
.8'i 
l!l<cl 
.. ., 
"p, 
A 
1 2 
1 8 
1. 2 
.2 
1 8 
1. 2 
8 


Total deviation=8 2 
Average deviation=l 2 


FIGURE le 


10 
I 


9X14 


"O 
J 
1 
2 
3 
4 
5 
6 
7 
8 
g ... 


1 I S T B R T A T F 2 
2 L 0 R F I U 0 N A 5 
3 H N R A I T N F T 2 
4 H S H E A C A R Y 4 
5 D 0 N D R U J A E 4 
6 T 0 E F I V I N C 4 
7 I E A 0 V R U F F 5 
8 E E T Y N A P M X 4 
9 0 E N C L U 0 N R 4 
10 E E N A R 0 L D T 4 
11 U I VP N 0 RM G 3 
12 D 0 U D R 0 S A E 5 
13 H E T T W F 0 S T 2 
14 T F L R E D M A A 3 


1 6 
1 4 
1 6 
4 
4 
4 
1 4 
4 
4 
4 
6 
1 4 
1 6 
6 


Total dev1ation=12 6 
Average deviation= 
9 


FIGURE If 


The average amount of deviation for assumpt10n (5) is only O 9 as agamst 1 2 for assumption 
(3), therefore the former assumpt10n 1s considered to be somewhat better than the latter and it will 
be tried first 
d The columns of the rectangle shown m figure If are now to be cut apart and the procedure 
of anagrammmg apphed 
(For this it is best to have the cryptogram written on cross-section 
paper preferably with ~'-mch squares for ease m handlmg) 
Consider column 7, with the letter 
J m row 5, this letter, if it is a part of a word, must be followed by a vowel, which ehmmates 
columns 1, 3, 4, and 5 as possibilities for placement on the right of column 7 
Here are the 


digraphs formed by combmmg column 7 with columns 2, 6, 8, and 9, respectively, and the totals 
obtamed by addmg the frequency values of the digraphs formed m the rows 


' ' 
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(The frequencies shown are as given m table 6, appendix to Military Cryptanaly8i8, Part I) 


(1) 
(2) 
(3) 
(4) 


t' 
t' 
p, 
t' 
" 
~~ 
~~ 
lil"' 
<l<D 


§.Ol 
i1 
::;.El 
~~ 
C'" 
g~ 
"'~ 
"~ 
ii; 
7 
6 
7 
8 
... 
7 
9 
... 


7 
2 
"" 
"" 
"" 
A s -- ------ 
41 
A T __________ 
47 
A T _____ ---- 
47 
A F __________ 
4 


0 Q __________ 
6 
0 u __________ 
37 
0 N_ 
- 
- 
77 
0 A __________ 
7 
N N __________ 
8 
N T _ -- ----- 
82 
N F ___ 
- - 
9 
N T __________ 
82 
A s ___ ----- 
41 
A c __________ 
14 
A R _______ 
44 
A y __________ 
12 
J 0 --------- 
2 
J u __________ 
2 
J A ____ 
J E __________ 
2 
I o _______ -- 
41 
I v _____ ---- 
25 
I N 
75 
I c __________ 
22 
u E __________ 
11 
u R __________ 
31 
u F _ - --- 
1 
u F __________ 
1 
p E __________ 
23 
p A __________ 
14 
p M -- - ---- 
4 
p x __________ 
0 
0 E __________ 
3 
0 u __________ 
37 
0 N_ -- 
- 
77 
0 R __________ 
64 
L E __________ 
37 
L o __________ 
13 
L D -- - -- 
9 
L T __________ 
8 
R ! __________ 
30 
R o __________ 
28 
R M_ _________ 
9 
R G __________ 
7 
s 0 --------- 
15 
s o __________ 
15 
s A _____ ---- 
24 
s E __________ 
49 


0 E __________ 
3 
0 F ---------- 
25 
0 s ___ ------ 
14 
0 T _________ 
19 
M F ---------- 
1 
M D __________ 
1 
M A __________ 
36 
M A_ -------- 
36 


TotaL __ 262 
Total_ _____ 371 
Total_ ___ 427 
Total_ ___ 313 


FIGURE 2 
Combmat10n (3) gives the lnghest frequency value for the digraphs and an attempt is made to 
add a column to it 
Here are some of the combmat10ns tried 


7 
8 
I 
7 
8 
2 
7 
8 
3 
7 8 
9 


A T I 
A T S 
A T T 
A T F 


0 N L 
0 N 0 
0 N R 
0 N A 
NF H 
N F N 
NF R 
N F T 
ARH 
AR S 
ARH 
ARY 
J A D 
J A 0 
J A N 
J A E 
I N T 
I N 0 
I N E 
I N C 
U F I 
U F E 
U F A 
U F F 
P M E 
P M E 
P M T 
PM X 


0 N 0 
0 N E 
0 N N 
0 N R 
L DE 
L DE 
L D N 
LDT 
RMU 
RM I 
RMV 
RMG 


S A D 
S A O 
S A U 
S A E 


0 S H 
0 S E 
0 S T 
0 S T 
M A T 
MA F 
MAL 
MA A 


FIGURE3 


e Each of these combmations shows at least one "impossible" trigraph and several "poor" 


ones 6 
After more or less work along these Imes, the crypta,nalyst begms to get the f eehng that 


"somethmg is wrong," for, as a rule, once a correct start has been made m cases of this kmd, 
solution comes rather qmckly 
Hence, the cryptanalyst decides here that possibly his first 


• Followmg the steps taken m subpar d, frequency weights may be given the various trigraphs m fig 3 and 
the sums obtamed taken as mdicat10ns of the relative probability of each of the four trials 
These steps are here 
omitted, for they are obvious 
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choice of combmation (3) was a bad one, even though it gave the grC'atest total when frequency 
values for the digraphs were summed 
The second greatest total was fo1 combmation (2) m 


which columns 7 and 6 were put together 
The mfrequent digraph J U suggests a word such as 


JUST or JUNCTION 
Ifi t wei e the former there should be a column conta.mllig an S m the 5th row, 
and there is no such column 
If the word is JUNCTION, there should be a column contammg an N 
m the 5th row, and there is only one such column, the 3d 
Placmg column 3 after columns 7-6 


gives the trigraphs shown m figure 4-A 
All of these tngraphs are excellent except the last, and 
that one may be either an abbreviation of a signature, or possibly nulls added to complete the rec- 
tangle If the word JUNCTION is correct then there should be a column with a Cm the 5th row, but 
none is found 
However, column 9 has a C in the 6th row, and if it happened that the last column 
on the nght is No 3, then column 9 would be the 1st column 
Thus, as shown m figure 4-B, the 
arrangement of columns becomes 9 
7 6 3 


7 
6 
3 
9 
T ? 
' 
? 
? 
7 
6 
3 
9 
1 
6 
2 
8 
' 
7 
6 
3 
A T T 
F 
AT T 
F I R S T B A T T 


0 UR 
A 
OUR 
A L I 0 N F 0 U R 
N T R 
T 
NT R 
THINFANTR 
A C H 
y 
AC H 
YHASREACH 


J U N 
E 
J U N 
EDROADJUN 


I V E 
c 
I V E 
C T I 0 N F I V E 


UR A 
F 
UR A 
FIVEFOURA 
PAT 
x 
P A T 
XENEMYPAT 
0 UN 
R 
0 UN 
ROLENCOUN 


L 0 N 
T 
L 0 N 
TEREDALON 


R 0 V 
G 
R 0 V 
G U N I M P R 0 V 
s 0 u 
E 
s 0 u 
E D R 0 A D S 0 U 
0 F T 
T 
0 F T 
THWESTOFT 


MDL 
A 
MDL 
ATEFARMDL 


FIGUBll: 4-A 
FlGVl!.11: 4-B 
FlGVBll: 5 


f It is beheved that the procedure has been set forth with sufficient detail so as to make 
further demonstration unnecessary 
The rectangle can be completed very qwckly and is found 
to be as shown m figure 5 
g It will be mterestmg to see if a calculation based upon the sum of the loganthms of the 
probab1ht1es given m figure 2 would have given the correct combination as the first choice 
Note the results shown m figure 6 
Tlus calculation gives the correct combmation as first 


choice, viz, 7-6, with a logarithmically-weighted value of 17 35 as agamst a value of 16 51 for 
combmation 7-8, which was the first one tned on the basis of merely the sums of the frequency 
values of the digraphs 


7 
2 


A Sr----- 
0 Q ____ _ 
N N ___ _ 
A s ____ _ 
J Q ____ - 
I Q ___ - 
U E __ _ 
p E _____ _ 
0 E ____ _ 


L E ---- 
R r_ ____ _ 
s o _____ _ 
0 E ___ _ 
M F _____ _ 


( 1) 


t' 
Ii!§ 


~-: 
p., 
41 
6 
8 
41 
2 
41 
11 
23 
3 
37 
30 
15 
3 
1 


a 
J 


1 61 
78 
90 


1 61 


30 


1 61 
1 04 
1 36 
48 
1 57 
48 
1 18 
48 
00 


7 6 
A T _____ _ 
o u ____ _ 
N T ____ _ 
A C _____ _ 
J u_ -- 
I V ____ _ 
u R_ ____ _ 


p A ---- 
0 u ___ _ 
L 0 __ _ 
R 0 ___ _ 
s o ____ _ 
0 F _____ _ 
M D ___ _ 


(2) 


"' ., 


~§ 


~-: 
p., 
47 
37 
82 
14 
2 
25 
31 
14 
37 
13 
28 
15 
25 
1 


l 
..:i 


1 67 
1 57 
1 91 
1 15 


30 


1 40 
1 49 
1 15 
1 57 
1 11 
1 45 
1 18 
1 40 
00 
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7 
8 
A T _____ _ 
O N ____ _ 
N F _____ _ 
A R_ __ - 
J A ___ _ 
I N ___ _ 
U F _____ _ 
p M_ ____ _ 
O N ____ _ 
L D ___ _ 
R M __ _ 
S A __ _ 
o s _____ _ 
M A __ _ 


(3) 


t' 
i!j 
!= 
47 
77 
9 
44 
1 
75 
1 
4 
77 
9 
9 
24 
14 
36 


j 


1 67 
1 89 
95 
1 64 


00 


1 88 


00 
60 


1 89 
95 
95 
1 38 
1 15 
1 56 


7 
II 
A F _____ _ 
0 A _____ _ 
N T _____ _ 
A y _____ _ 


J E_ --- 
I C ____ _ 
U F ____ _ 


p x.. ---- 
0 R _. 
L T ____ _ 
R G _____ _ 
S E ____ _ 
0 T ____ _ 
M A _____ _ 


4 
7 
82 
12 
2 
22 
1 
0 


64 
8 
7 
49 
19 
36 


j 


0 60 


85 
I 91 
1 08 
30 


1 34 


00 


-1 00 


1 81 


90 
85 
1 69 
1 28 
1 56 


Total ___ 262 
13 40 Total ___ 371 
17 35 Total ___ 427 
16 51 Total ___ 313 
13 17 


FlGUBll: 6 


As a mattet of interest, it may be observed that the combination 7-6 is 7 times more probable 
than combmat10n 7-8, smce the drlfeience between 17 35 and 16 51 is 84, which is the logarithm 
of 7 
Likewise, combmat10n 7-6 is roughly 15,000 times more probable than combmation 7-9 
smce 17 35-13 17=4 18 
' 
8 The probable-word method of solution -a The probable-word method of attack is as 
important m the solution of transpoSit1on ciphers as 1t 1s m the solut10n of substitution ciphers 
and if the cryptanalyst is able to assume the presence of such probable words as a.re usuan;. 
encountered m military commumcat1ons, the solution, as a rule, comes very qwckly 
b As an illustration, lookmg at the first row of letters m the rectangle shown m figure lj 
the letters I S TB RT AT F almost at once suggest FIRST BATTALION as the imtial words of th~ 
message 
A rearrangement of the columns of the cryptogram to bnng the necessary letters 
mto Juxtaposition at once discloses the key 
Thus 


9 
1 
5 
2 
8 
' 
7 6 3 


FIRSTBATT 
A L I 0 N 


It will be noted that this assumption reqwres that there be a column headed by F A, another 
headed by I L, another headed by R I, and so on 
Had such columns not been found, then the 
word BATTALION would not be possible 
In that case the word FIRST would still remam as a 
pomt of departure for further expenmentation 


c In the foregomg illustration, the probable word was assumed to appear m the first hne 
of text m the rectangle If the probable word bC'mg sought ism the mtenor of the message the 
steps must be modified somewhat but the basic prmciple remains unchanged 
The modifications 
a.re of course obv10us 


9 General remarks on solution.-a In solvmg transposition ciphers advantage should be 
taken of all the characteristics and id1osyncras1es which are applicable to the language of the 


324155--41-2 
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enemy, because they often afford clues of considerable assistance to the cryptanalyst 
In all 


languages there are certain letters, usually of medmm or low frequency, which combine with 
other letters to form digraphs of high frequency 
For instance, in English the letter H is of 
medmm frequency, but it combmes with T to form the digraph TH, which is of highest frequency 
m literary text, it also combmes with C, a letter of medmm frequency, to form the fw.rly frequent 
digraph C H 
The letter V is almost in the low-frequency category yet it combines with E to 
form the digraph VE, which in military text is the 14th m frequency 
The low-frequency letter 
K often combmes with C to form the digraph C K 
Consequently, in workmg with transposition 
ciphers m English, when there is an H, attempts should be made to combine it first with a Tor 
with a C, a V should be combined first with an E, a K should be combined first with a C, and so on 
b There is usually m every language at least one letter which can be followed by only a 


certam other letter, formmg what may be termed an obligatory sequence, 01 an invariable digraph 
In all languages havmg the letter Q, the combmation Q U constitutes suc,h an mvariable digraph 7 
In bonafide words of the German language the letter C is never used by itself, when present the 
lette1 C lb mvariably followed by an H, except on rare occasiom. when the digraph C K is employed 
In English, the letter J can be followed only by a vowel, the letter X can only be preceded by a. 
vowel and, except at tho end of a word, can only be succeeded by a vowel, or by one of a limited 
number of consonants (CH PT), and so on 
Letters which behave m this manner, that is, 


letters which have \\'hat may be called a limited affinity m combmmg with other letters to form 
digraphs, constitute good pomts of departure for solution and are therefore of sufficient impor- 
tance to warrant their bemg designated by the more or less descriptive name of pilot letters 


c The presence of pilot lette1s ma transp0Slt1on cipher often forms the basis for the assump- 


tion of probable words 
Obviously, a special lookout should be kept for words of rather high 


frequency (m military correspondence) which contam letters of low O!, medmm frequency 
The frequent word CAVALRY, for example, would suggest itself if the cryptogram has the letters 
C, V, L, and Y, which are all of medmm frequency 
The important word ATTACK suggests 


itself if the cryptogram has a K, a letter of low frequency, and a C, one of medmm frequency, 
and soon 
d The mechanics of srmple columnar transposition make possible the production of rather 
long sequences of vowels and long sequences of consonants m the text of the cryptogram 
Note, 
for example, m the cryptogram on p 6, the sequence of vowels 0 0 E E E E I 0 E, and the 
sequence of consonants V N L R N R W If the enc1phe1mg or plam-text rectangle lB con- 
sulted, it wtll be seen that these two sequences belong together, that is, they are m adJacent 
columns m that rectangle It is a characteristic of plam text that consonant-vowel or vowel- 
consonant digraphs are much more frequent than consonant-consonant or vowel-vowel digraphs,• 
and therefore when long sequences of consonants and of vowels are found m transposition 
ciphers, a good start toward solution may result from assummg that such sequences come from 
adJacent columns 


e. It should, however, be noted m connection with tell-tale letters such as Q (entermg mto 
the composition of Q U) and C (entermgmto the composition of CH), that astute cryptographers 
who realize the clues which such letters afford often replace mvanable digraphs by Slllgle char- 
acters, usually those rarely used m the language m question 
For example, C H m German may 
be replaced by Q, Q U m French, by K, and so on 
When this is done, solution is me.de more 


difficult, hut only m those cases \\'here it is dependent upon findmg letters formmg obligatory 
sequ<>nces m plam text does this sort of subterfuge become a factor of importance 


'The letter Q may, of course, be part of an abbreviation, such as SQ for "square," or 1t may be used as a null, 


er as a Sign of punctuation 
However, unless there are good reasons for behevmg that this letter 1s used for such 
purposes, QU may be considered to be an mvar10.ble digraph 
• The CV and VC digraphs constitute about 62 percent of all digraphs 
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J The presence of many Q's, or K's, or X's m a transposition cipher should not, however, be 
taken as prima facie evidence of the type of replacement noted m the precedmg subparagraph 
It 18 possible that such letters may be used as sentence separators or other punctuation, possibly 
they may be nulls, although the alert cryptographer would either use nulls not at all or, if he 
had to, would use letters of med mm or high frequency for this purpose 
g Because it is important that the cryptanalyst take advantage of every peculiarity specifi- 
cally applicable to a cryptogram to be solved, especially as regards the presence of low-frequency 
letters, it is advisable that a umliteral frequency distnbution be prepared, 1ust as though he 
were gomg to deal with a substitution cipher 
This is probably the qmckest way of bringing to 


4ght the peculiarities which may be helpful m solution 


10 Reconstruotlon of hteral key -a The reconstruction or recovery of the hteral key 
from which the numeucal transposition key was derived is naturally the last step m the solution 
of cryptograms of thlB type It is often of more than merely academw mterest, because if it is 
found that the enemy is employmg for this purpose some well-known book, or words or phrases 
of a simple nature associated with the locale of operations, this fact may be of highest importance 
m subsequent work 
b In this process there are only a few guidmg principles to be noted and much must be left 
to the mgenmty and imagmative powers of the cryptanalyst 
Takmg as an e~ample the numer- 


ical key uncovered m the solution of the cryptogram m paragraph 7, the procedure will be set 
forth below 
c The numerical key 1eferred to was found to be 9 1 5 2 8 4 7 6 3 
Assummg that this 


sequence was derived m the usual manner, by assignmg numbers to the letters of a key word m 
accordance with their relative positions m tho normal alphabet, the sequence forms the basis for 
the key-word reconstruction diaqram shown m figure 7-A, m which the mdividual key numbers are 
written from left to right on different "levels" so that each level contains only numbers normally 
m succession 


9 
1 
5 
2 
8 
4 
7 
6 
3 
9 
1 
5 
2 
8 
4 
7 
6 
3 
--= ------= 
= 
= 
= 
= 
= ----= 
= 
= 
ABC 
ABC 
ABC 
DE 
DE 
DE 
1 
1 
2 
3 
1 
1 
2 
3 
------------- ---- ---------------------- 
FOB 
11 


2 
4 
2 
4 
------------------ ------------------ 
KLM 
KLM 
NO 
NO 


3 
5 
6 
3 
5 
6 
------------------ 
------------------ 
LMN 
OP 


4 
7 
4 
7 
i ----------------- ----------- 
------ 
MNO 
PR 
5 
8 
5 
8 
,_____ ---------------- 
------------ 
I 


9 
I 
I I 
6 
R-Z 


I 


9 
I 
I 
6 


FI!'UBB7-A 
Fl!'Ulld. 7-B 


d It is likely that the digit 1 on the first level m the key-word reconstruction diagram 


represents a letter at or at least close to the begmmng of the alphabet 
Smee the dig1ts 2 and 3 


are on the se.tne level as the digit 11 it 18 likely (1) that the letter represented by 1 occurs 2 more 
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t1mes m the key word, or (2) that the digit 2 represents another letter, also near the begmrung of 
the alphabet, and that this letter is repeated, or (3) that the digits 2 and 3 represent 2 different 
letters both near the bcgmnmg of the alphabet, or (4) that all three digits represent different 
letters hut all near the begmmng of the alphabet 
The digit 4, on the second level m the recon- 


struction diagram, must represent a letter beyond the letter represented by the digit 3, the digit 
5 must represent one beyond the letter represented by the digit 4, and the digit 6 may represent 
the same letter as 5, or a letter not much beyond that represented by 5 
Assummg that the 
letters composmg the key word are fall'ly well distributed over the entire alphabet, the digit 7 
must represent a letter near or slightly beyond the middle of the alphabet, the digit 8 must repre- 
sent one further toward the end of the alphabet than does the digit 7, and so on 
Assignmg 


several values to the digits, m accordance with the foregomg prmmple, the results are as shown 
m figure 7-B 
e It 1s perhaps possible that some students may find the process of reconstructmg the hteral 
key somewhat easier 1£ the variant possible letters are merely hsted under the respective key 
numbers as shown m figme 7-C 
The candidates for the succesSive positions m the literal key 
thus appear m a rather condensed space and the eye 1s able to pick up "good" combmat1ons 
very qmckly 


9 
1 
6 
2 
8 
4 
7 
6 
3 
RAKAMFLKA 
SBLBNGMLB 
T C M C 0 H N M C 
U D N D P I 0 N D 
VEOERJPOE 
w 
x 
y 
z 


FIGUU: 7-C 


f Now comes the trymg process of findmg a "good" word m this assemblage of letters 
The 
begmnmg and end of the word are the easiest pomts of attack, and 1t is useful to keep m mmd the 
relative frequency order of letters as l.IUtial and final letters of the language m question 
For 


English, the data are as follows 9 


As rmt1al letters ______________ T S A F C 0 R D N P E M I W B H L U G Y V J Q K Z X 
As final letters _______________ E T D S N Y R 0 H L A F G P M X C K W U B I Z Q J V 


Studymg the candidate letters at the end of the key, it is seen that E is one of the possib1hties 
If that 1s correct, then a good endmg would be one of the type vowel-consonant-vowel, with E as 
the final letter 
There 1s but 1 vowel m the fourth level m the column under the digit 7, the 
letter 0 
This gives 0 K E, 0 L E, 0 M E, 0 N E as possible termmal trigraphs, the best of which 


from a frequency standpomt is ONE 
Seemg the letters P and H m columns 8-4, the endmg 
PHONE and then the word TELEPHONE suggests itself 
Checkmg to see if there are any mcon- 


s1stenc1es, none is found and the solution is 


N umencal key ______ g 1 5 2 8 4 7 6 3 
Literal key ___________ T E L E P H 0 N E 


•Taken from Tables 2--D (2) and 2--E (2), p 111, Military Cryptanalysu, Part l 
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g In future studies, cases will be encountered wherem the reconstruction of the numerical 


key 18 an essential or, at least, a useful element after the solut10n of one or more cryptograms has 
been achieved by cryptanalysis 
This 1s done m order that subsequent cryptograms m the same 
key can be read dll'ectly without cryptanalysis 
The reconst1 uct1on of the numerical key 1s, 
however, a different process than the one illustrated m this paragraph, wherem the problem is 
solely one of building up a literal key from its numerical eqmvalent 
The purpose m reconstruct- 
mg the literal key is to give clues as to the source from which keys are derived or taken 
Some- 
times this may lead to ascertam1ng a book which is used for this purpose and which may be 
ava.tlable by purchase at bookshops, or 1t may be a well-known document, a telephone directory, 
etc 
Obviously, if the source document or book can be located the solution of future crypt::>- 
grams m the same system becomes merely a matter of decipherment and such cr.} ptograms no 
longer form the matenal for cryptanalytic efforts 
The method of reconstructmg the hteral 
key JS, obviously, easier to apply m the case of long numerical keys than m the case of short ones, 
m general, the longer the numerical key the easier is the recovery of the hteral key 
11. Column and row transpos1tlon-It should be obvious that when the rows as well as 
the columns of a completely-filled rectangle undergo transposition the mcrease m security JS 
hardly worth mention, smce the underlymg procedure m solution aims simply at assemblmg a 
few columns on the basis of "good" digraphs and tr1graphs brought to light by 3uxtaposmg 
columns 
After three or four columns have been properly 3uxtaposed, the placement of addi- 
tional columns becomes easier and easier, merely by contmumg to bmld upon the fragments of 
words in the rows 
Hence, the cryptanalyst is, durmg a large part of the proces&, not particularly 


mterested m the mtellig1bil1ty of the text he JS buildmg up, only at the end of the process does 
th.is become a factor 
When all of the columns have been assembled m proper order, then the 


text will read contmuously m the normal manner (left to nght, top to bottom) 
If it does not, 
then it is usually a very sunple matter to rearrange the rows of the rectangle to brmg this about, 
smce the letters at the ends and begm.nings of the rows give the necessary clues for contmu1ty 


,,, 
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SECTION III 


INCOMPLETELY-FILLED RECTANGLES 


General prmmples undcrlvmg solut10n _ _ 
_ ___ __ __ 
_ ------ ------- 
_ _ ___ _ 


D:i 1m1tmg tlie lu1gt'1'3 of the colmuns of the rt>ct.wgll:', conotru(,tmp; th(, "hat" d1.tgi d.ID 
Solution of eicample_ _ _ _ __ ___ 
-------- _ _ 
------- ____________ _ 
Alternative method of solution_ _ __ _ _ __ __ _ 
---------- ___ _ 
Concludmg rPmarks on sunple columnar transpos1t1on 
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12 General principles underlying solution --a In the system designated keyed columnar 
transposition the feature which differentiates an illcompletely-filled rectangle from one that is 
completely filled 1s a very simple one from the cryptograpluc pomt oI view The bottom row of 
the rectangle ill the former case merely lacks one or more lette1s, a featme which only very 
slightly complicates the syE>tem m practical opriation 
But the consequences of this simple 


difference between the two types are, from the cryptanalytic> pomt of view, qmte p1ofound, and 
the cryptanalytic effect of this small c>hange m cryptographic procedure is '-Pemmgly all out of 
proportion with the simphmty of the difference 
b Cryptograms mvolvmg completely-filled rectangles are 1 a.th er easy to solve because of two 
Cll'cumstances 
In the first place, smce the rectangle is completely fillPd, the vanous possiblP 


dimensions of the rectangle can be ascertamPd by notmg the factors of the total number of letters 
Usually only a few possibilities ar<' mdicated and the1 eforp tlus matenally reduces the amount of 
expenmentat1on that '\\ould be ieqmred m the absence of this situat10n, smce it is obvious that 
when workmg with illeomplctely-filled 1ectnngles a good many rectangles of various drmens10ns 
become poss1lnhties for tual 
In the second place, thl' columns m a completely-filled rl'ctangle 


all contam the same numbe1 of lettl'rs, and therefore the anagrammmg process (matching and 
assemblillg of columnq) can be performed without any mPntal 10qervat10nq such as must be mad£' 
ill workmg with illcompletely-filled 1 ectangles because• of uncc1 tmnty as to whether the letters 
which are Juxtaposed to form digraphs nnd tugrnphE> rrally c.omc f10m the same iow m the plam- 
text rectangle 
The latter statement call-; for a bit m01e rxplana.tion 


c The columns of an mcompletely-fill<'cl rrctanglc arc of two soi ts whu h may convcmently 
be des1gnat<•d as long and -;hort 
The long columnq .trc at the ldt of the iectangle and ca.c,h one 
contams JUSt one more lette1 than the short columns, wluc,h arc at the right 
This follows, of 
comse, from the fact that it is only thr lu-.t 1ow ill such a 1ectangle wlmh l.t( kq one or more lettms 
to complete the rectangle 
The term wulth, aE> apphed to a transpos1t1on rN ta.ngle, will be con- 
vement to designate the number of columns, which 1q, of course, determmed by the length of the 
numerical key or the number of letters m the literal key 
G1v<>n the width of the rectangle and 
the total number of letters m the cryptogram, tho length and number of the long and the short 
columns may be found by a simple calculat10n Multiply the width of the rectangle by the 
smallest number whwh will ywld a p1oduct greater than the total number of letters ill the 
cryptogram 
The multiplier gives the h•ngth of the long columns, this mult1phcr millus 1 gives 


the length of the short columns, the excess over the total number of letters ~Ives the number of 
short columns, the latter deducted from the width gives the number of long columns 
Thus, 


with a cryptogram of 287 letters and a rectangle 15 columns m width [(15X20)-13 287) the 


(18) 


l 
i 
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long columns will have 20 letters, the short ones, 19 letters, there will be 13 short columns and 2 
long ones 
d Now 1f the c1yptanalyst were able to cut up the te:xt of a cryptogram produced from an 
incompletely-filled rectangle mto sections correspondmg m length with the actual long and short 
columns, he could handle these columns m exactly the same manner that he handles the equal- 
length columns m the solution of a cryptogram produced from a completely-fillPd rectangle 
In 
fact, the solution would be easier because hP knows that all the short c>olumns fall at the right, 
all the long columns at the left of the transpos1t1011 rectangle, and theref01e the amount of cxpen- 
mentat1on he must undertake ill lus attempts to Juxtapose columnq m the anagrammmg proceqs 1s 
considerably rPduced 
But, unfortunately, there 1s usually no way ill wluch, at the m1tial stage 
of solution, the cryptanalyst can fmd out, f1om a smgle c1yptogrnm, whwh a10 the long columns 
and which the short 
This is obviously a matter directly connected with the specific, tra.nspos1- 


tion key, and the latter is the sole unknown factor m the whole problem 
e If it were practicable to transcube a rryptogram of this type accordmg to all the possible 


transposit10n kl'ys for a given width of rectangle, solut10n would obviously meicly consist m 
scanning the vanous rectangles to find the one which 1s correct-for there will be only one such 
rectangle 
A rectangl<' 15 columns m width may have been enciphered by any one of factoual 
15 transposition keys 1 
"\\'1.ule it is concl'lvable that machmery might be devised fo1 this purpose, 
so that the production of the millions of possible rectangles could be effected m a rl'latively short 
trme, ill the present state of the art no such mac>hmery has yrt been devised 
Fm the1more, it 1s 
problematical whether a solution by such means could be achieved ill a 1ca01onable length of time 
even if the machrnery were available, because of the mrmcnsity of the task 1t would have to 
perform 2 
j Ho'\\ ever, tlus question may be askrd Given a cryptogram of t letters and a rectangle of 


n columns m width, 1s it possible to transcube the te~t w1thm a smgle rrdangle so that the latter 
will show what letters will constitute the respective columns for all possible transposition kl'ys of 
n elements? If so, then such a rectangle would be usrful m tryillg to solve the cryptogram, 
because thl' rectangle would then hrmt the amount of exper1mcntat1on that would have to be 
performed by the anagrammillg process, sillce it would show whether or not two letters which 
are brought together m that process to form a digraph could possibly have be('Il m the same row 
m the plam-text rectangle 
If not, then of course there would be no use m formmg such d1gi aphs, 
and thus the numbe1 of trials becomes much reduced 
Another way of illd1ratmg what 1s meant 


is to say that smh a rectangle would show the maximum amount that one column may be sh1ft£>d 
up or down ill trymg to matd1 it with another column ill the anagrammmg proccqq 
This will be 
made clearer ill a subE>equent paragraph 
At this poillt 1t will merely be statrd that it 1s easy to 
prepare a rectangle of the nature md1catcd above for any keyed, columna.r-tianspoSitJ.on 
cryptogram 


1 Factorial 15, or 15X 14X 13X 
X 1, equals 1,369,944,576,000 different transpos1t1on keys 


I It 1s nevt>rt'ieless pertmt>nt to md1cah, that mac'imery for fac1htn.tmg the "makhmg" or dll&itrammmg of 
columns has bet>n devised and found to be qmtr pra(,t1cal m the "Olut1on of prohlem<11mohmg columnar trans- 
position 


L 
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13 Dellm1tmg the lengths of the columns of the rectangle, constructmg the "hat" d1a· 
gram -a Given the followmg cryptogram of 224 letters and an as'lumed width of 12 columns 
10 the enc1phenng rectangle 


0 D N N P 
D S T E 0 
M S C L C 
F M B I E 
TNDAH 
E A 0 0 T 
A ENE E 
A L 0 D I 


T I R N T 
IT D MA 
S 0 E F C 
H B VTB 
I R H Q I 
HE AC N 
M Y T F I 
R 0 RY N 


~ 


CRYPTOGRAM 


D TUR 0 
NL N 0 E 
F F T E E 
E S R S Y 
E T E T N 
SHE EV 
TAN L N 
NRGY 


EXALN 
B 0 UH E 
E M I A I 
L X R 0 R 
0 TR A A 
TR ES R 
NU AC L 


DISTRIBUTION 


~ 
~ 
~ 
~ 
- 
~ 
~ 
~ 
~ 
~ 
~ 
~~ 
~~~ 


I E T G N 
NL ESE 
T E A I J 
UM ET Y 
V R I R S 
A I I E A 
REN RT 


~ 
--~- 
-~ 
~~~~ 
~~~ 
~~~~~~~~~-~~~~~--~~~~~-~~ 
ABCDEFGHIJKLMNOPQRSTUVWXYZ 


WT TM E 
A ACT R 
N S 0 I V 
0 I K N K 
T G S E' F 
TEE AL 
RATS 0 


1114 
8 8816 3 6161211720151118122&4412110(224) 


b A cryptogram of 224 letters and a rectangle of 12 columns [(12X19)-4=224] 10d1cates 4 
short columns of 18 letters and 8 long columns of 19 letters The outlmes of a rectangle of thlS 
specification are drawn on a sheet of cross-section paper and the text 18 transcnbed w1thm it, 
for the moment asswnmg only that the transposition key conslSts merely of the straight sequence 
of numbers 1 to 12 
Thus 


1 
2 
3 
4 
II 
6 
7 
8 
9 
10 11 12 
ONMCMHYTOAFA 
D I A T I B 0 N 0 I I T 
N E N R A V I 0 T I T S 
NTLMITKTHEAO 
PGNSTBNREANA 
TNOCEEKAATLL 
I W E L A S T A C E N 0 
RTBCIRNVNEND 
N T 0 S J S D R S A U I 
TMUONYAIHLAR 
DEHESLHREACO 
T D E F 0 X I S E E L R 
USNCIRRTVNRY 
RTLFVOHGTEEN 
OEEFFRQSRENN 
EOSTMUIEEMRR 
X I E E B M E F S Y T G 
ATAEIETERTRY 
LDAEETEA 


FIOVBB8 
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c The rectangle shown 10 figure 8 is the same as though it had been assumed that the key 
numbers 9, 10, 11, and 12 happened to fall at the extreme nght m the numencal transpos1t1on 
key Columns 1to8, 10clus1ve, would then be long columns, and columns 9, 10, 11, and 12 would 
be short columns But suppose that the key numbers on the e::o..treme nght happened to be 1, 2, 
3, and 4, mstead of 9, 10, 11, and 12 
Then columns 1, 2, 3, and 4 would be the short columns, 
5 to 12 the long ones In this case, makmg reference to figure 8, the final letter of column 1 
would pass to the top of column 2, the final 2 letters of column 2 would pass to the top of column 
3, the finnl 3 letters of column 3 would pas!> to the top of column 4, the final 4 letters of columns 
4, 5, 6, 7, and 8 would pass to the top of column'l 5, 6, 7, 8, and 9, the final 3 letters of column 
9 would pass to the top of column 10, the final 2 letters of column 10 would pa'ls to the top of 
column 11 , and the final letter of column 11 would pass to the top of column 12 
The results of 
the foregomg rf'aso010g are embodied m the matrix or dmgram shown lil figure 9 


1 
2 
3 
4 
5 
6 
7 
ll 
II 
10 11 12 


1 
tmuie 


2 
e e b m e t e 
3 
t a e i 
e t e s y 
4 
1 d a e e t e a r t r 
5 ONMCMHYTOAFA 
6 
D I A T I B 0 N 0 I I T 
7 N E N R A V I 0 T I T S 
8 
N T L M I T K T H E A 0 


9 PGNSTBNREANA 
10 T N 0 C E E K A A T L L 
11 
IWELASTACENO 


12 R T B C I R N V N E N D 
13 
N T 0 S J S D R S A(i,!)I 


14 
T M@O N Y A I H L A R 
15 D E H E S L H R E A C 0 
16 
T D E F 0 X I S E E L R 
17 @s N C I R R T V N R Y 
18 R T L F V 0 H G T E E N 
19 OEEFFRQSRENN 
20 E 0 S T M 
I E E M R R 
21 
X I E E B M E F S Y T G 
22 ~A EI ET ER TRY 
23 L D A E E T E A 


FlOVBB 9 


d Now the capital letters 10 this matn."< or diagram, which is often called a crown or hat 
diagram,3 figure 9, represent the l~tters which are m the columns m case the fir ... t hypothesis 
(key numbers 9, 10, 11, 12 u.t the extreme nght) is true 
The capital letters t1bovc the heavy 


blt1ck hoe together with the lower-case letters at the top of the diagram represent the letters 
which are m the columns m case the second hypothesis (key numbers 1, 2, 3, 4 at tho extreme 
nght) is true 
Therefore, smce the hat diagram covers the two possible extremes with reference 
to the pos1t1ons occupied by the short columns and embraces all possible mtermed1ate cond1t1ons 
by showmg what letters may be m the respective column& under any possible arrangement of long 


a Because the lower-case letters at the top form what 1s usually called the crown or hat 


c.. 
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and short columns, the hat diagram is applicable to any possible numerical key jor the cryptogram 
in question and for the assumed 111idth oj rectanqle 
Therefore, m the anagrammirg process the 
hat diagram shows the maximum posbible amount that any column may be shifted up or down 
m Juxtaposing two columns to form digruphs of lettPrs assumed to come from the same row 
m the pla.m-te~t rectanglP 
Tlns is because all the lette1s of th<' first row of the actual enci- 


phermg rectangl<' will be found m rows 1 to 5, mclusive, of figme 9, all the letters of the second 
row of the rectangle will be found m rows 2 to 6, mclusive, and so on, as mdicated by the hracrs 
at the ru~ht m figure 9 
e Thus there arises the followmg rmportant pnnciple Designatmg the number of short 
columns m a specific diagram by n, only such lette1s as foll '\\ ithm (n+ I) consecutive rows, will 
be letters that may have uppeared m the same row m the actulll transposition rectangle 
Or, 


another way of <>tatmg the prmciple is this Both member<> of any pair of Ietteis actually m the 
same row m thP trnnspo<>1tlon iectangle will be formd only among the letter<> appearmg m (n+l) 
consecutive rows m the rnriect hat diagrnm 
In the cas<' 11ndr1 discus"10n, if the first lette1 


of such a pmr l" located Ill row 8, for e>.ample, the other letter cannot be m ro\\<s 1, 2 3, or 13 to 
23 of figure 9 
f The usefulne">s of this principle m ronnect1011 with the coustrnct10n nnd emplo)ment of 
the hat diagram "'ill soon bewme apparent 
For Hample, ag.un referr111g to figure 9, take the 
lette1 Q rn ro" 1 <),column 7, it mu<it be follo\\'ed by a Um the plam te~t 
There nrc 4 U's m the 
message they are m row 13 column 11, row 14 column 3, row 17 column 1, and row 20 column 6 
Now the question is, ca.n any of these 4 U's follow the.)1', or may one or more of th<.'m be ehmmated 
from con<>1dernhon at oncel Smee the U's m row<> 13 and 14 fall outside the 4 conbecutive rows 
above that m w}nch the J1 is located, it follo'\\s that ne1ther one of thec;,e U's can be the one that 
succeeds the lt1 
Thus two candidates are automatically Phmmated from con<iiderution 
Tl1e U 


m row 17 and the U m 10w 20 are both possible candidates 
14 Solution of example -a With the forcgomg prehmmarie'> out of the \\'ay, the "olutxon 


of the cryptogram can now be carried forward with rapid progress 
It ha<> been md1cated that 
the Q m row 19, column 7 (fig 9), may be rombmed with either the Um row 17 column 1, or the 
Um row 20 column 6 
Suppo<>e the columns of figure 9 are now cut apart for ease m anagrnmmmg 


Juxtapo'>mg the mdicated column<i yields what I<i <ihown m figure 10 
Rmce the combmahon 
shown at am figme 10 mvolves column 1, it ob"\'IOU"ly begms with the letter 0 and ends with the 
letter A or L, no other letters can be added to this column 
Smre column 7 is already the maxi- 


mum length th1<> column can he under any circum<>tances, no letter.. run be added to it at the 
bottom 
The1 Pfore, all the digraph.., possible to fmm by 1uxtaposmg thc<ie two columns are 
md1cated m figure lOa 
There are only 17 digraphs m all, wherea" there "lhould be at le.1st 18 


7 
1 
1 e 


u 
u b 
m 
m 1 


e 
e e 
t 
t H 
y 
y B 


0 
0 v 
I 0 
I T 
K D 
KB 
N N 
NE 
KN 
K S 


T p 
TR 
NT 
NS 


D I 
Dy 
AR 
AL 
HN 
H X 


I T 
I R 
RD 
R 0 


HT 
HB 
QU 
gu 


I R 
I M 
E 0 
EE 
TE 
TT 


EX 
E 


A 
L 
a 
T 
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4 
7 e 
-e 
a u b 
a m 1 
c e e 
T t H 
RY B 
M 0 V 
S I T 
CK B 
L NE 
C K S 
ST R 
0 N S 
EDY 
FA L 
CH X 
F I R 
ERO 
THB 
E g U 
E I M 
E E E 
T T 
E 


c 


FIGURE 10 


au b 
a m 1 e 


0 r c e e s 
D A T t H r 
NTRYBA 
NSMOVI 
P 0 S I T I 
T A C K B E 
I L L N E A 
ROCKST 
NDSTRE 
T I 0 N S E 
DREDYA 
T 0 F A L L 
URCHXA 
R Y F I R E 
ONfRON 
ENTHBE 
XREQUE 
AGE IMM 
LXEEEY 


T T T 
E 


d 


Hence, combmat1on 7-1 is impossible, and combmat10n 7-6 is the only one that needs to be 
considered further 
There are many excellent digraphs m it, and only one which adnnttedly 


looks rather bad, the H X 
Seemg the digraphs K B and K S m these columns, a good assumption 
to make 1<i that the K's are preceded by the letter C 
Is there a column with 2 C's m approxrmately 
the coriect region? Column 4 meets this requirement 
Note the excellent tngraphs it yields, 
as shown m figure lOc 
It now becomes fairly easy to add columns to this nucleus 
For mstance, 
the tngraph R Y B suggests a word endmg m R Y, such as INFANTRY, ARTILLERY, CAVALRY, 
the tr1graph M 0 V suggest MOVING, the tngraph C K B suggests the word ATTACK, followed by 
a word begmnmg with B, and so on 
Trial of only a few columns soon yields what is shown m 


figure lOd, from which it soon becomes probable that the long columns end with column 12, smce 
the letter.. after L Y yield an rm possible sequence (E E E Y) 
Smee it was or1gmally assumed 
that theie are only 4 short columns m the transposition rectangle, and smce 4 columns have 
already been placed at the nght (4-7-6-10), the rectangle, with the columns thus far placed, 
must be as shown m figure lOe 
This, then, at once tells what the lrmits of columns 2, 3, 5, 8, 9, 
and 11 must be, and the rectangle can now be filled m without further delay 
The completed 
rectangle is shown m figure 11 
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10 


11 


12 


13 


14 


15 


16 


17 


18 


19 


1 
12 
4 
7 
6 
JO 


I 
I 
I 
I 
I I 
0 R c E E s 
- --1-- - 
- 
D A T T H R 


- 
- 
- -- - 
- 
- 
- 
- 
- 
- 
- 
N T R y B A 
-- - 
- 
- 
- 
- 
- 
~- - - - 
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I 
N s M 0 v I 
- --- 
- 
- 
- 
- 
- 
- 
- 
- 
p 0 s I T I 
- - 
- 
- 
- 
- 
- 
- 
- - 
- 
-- 
T A c K B E 
- - 
- 
- 
- 
- 
- 
-- - 
- 
- 
- 


I L L N E A 
- - 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
R 0 c K s T 


r---i--- 
- 
- 
-- - 
- 
- 
- 
-- 
N D s T R E 


c----,- - 
- 
- 
- 
- 
- 
- 
- 
-- 
I 
I 
T I 0 N s E 
- -1-1- - 
- 


--1- 


D R E D y A 


T 0 F A L L 
- - 
- - 
- 
- 
-- - 
- 
- 
- 
- 
u R c H x A 


r-- - 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
R y F I R E 


c--- - 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 


0 N F R 0 N 
- 
- - 
- 
- - 
- - -- - 
- 
- 
E N T H R E 
- - 
- 
- 
- 
- 
- 
- 
- --- 
- 
x R E Q u E 
- 
- 
- 
- 
- 
- 
- 
- 
- 
-- - 
- 
A G E I M M 
- - 
- 
- 
- - 
L y 
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10 


11 


12 


13 


14 


15 


16 


17 


18 


19 


s 
2 
5 
a 
11 
9 
1 
12 
4 
7 
6 
10 


E N EIM y ~1~ 


R c E E s 


------~~ 


T I M A T E D A T T H R 
-- - 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
E E I N F A N T R y B A 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
-- 
T T A L I 0 N s M 0 v I 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
N G I N T 0 p 0 s I T I 
-- - 
-- - 
- 
- 
- 
- 
- 
- 
- 
- 


0 N T 0 A T T A c K B E 
- 
- 
-- - 
- 
- 
- 
- 
- 
- 
- 
- 
T w E E N H I L L N E A 
- 
- 
- 
- 
- 
- 
- 
- 
- ---- - 
R T A B L E R 0 c K s T 
- 
- 
- 
- 


NIA 


- 
- 
- 
- 
- 
- 
A T I 0 
N D s T R E 


A M J u N c T I 0 N s E 
- 
- 
- 
-- - 
-- - 
- 
- 
- 
- 
- 
v E N H u N D R E D y A 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
R D s E A s T 0 F A L L 
- 
- 
- 
- 
-- - 
- 
- 
- 
- 
- 
- 
I s 0 N c H u R c H x A 
- 
- 
- -- - 
- 
- 
- 
- - 
- 
- 
R T I L L E R y F I R E 
- 
- 
- 
- 
- 
- 
- 
- -- - 
- 
- 
s E v E R E 0 N F R 0 N 
- 
- 
- 
- 
- 
- 
- --- 
- 
- 
T 0 F s E v E N T H R E 
- 
- 
- 
- 
-- - 
- 
- 
- 
- 
- 
- 
G I M E N T x R E Q u E 
- 
- 
- 
- 
- - 
- 
- 
- 
- 
- 
- 
s T B A R R A G E I M M 
- 
- 
- 
- 
- 
- 
- 
E D I A T E L y 


FIGURE 11 
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b The last step, recovermg the literal key, is then taken 
The key is to be found among 
the letters of the literal key reconstruction diagram rn figure 12 


8 
2 
5 
3 
11 
9 
1 
12 
4 
7 
6 
10 


- 
------ - 
------- 
-- - 
-- 
ABC 
1 
- 
-- -1-;;EF ---i-------- 
- 
DEF 
DF~ 
QIU 
IOHI 
ORI 


2 
3 
4 
- 
- 
- 
--- 
- 
-- - 
- 
---- - 
JKI 
JKL 
MN 
MN 
5 
6 
- 
- 
- 
---- - 
- 
- 
- 
- 
- 
- 


MNO 
I 


PQ 
7 
-- - -1--- 
- 
- 
- 
-- - 


NOP 
NOP 
NOP 
RST 
RST 
RST 


8 
-1-1~ 


9 
10 


R-Z 
I 
11 
12 


FIGURE 12. 


The termmatwn ATIONS seems a hkely possibility 
If this is correct, assignment of letters 
becomes modified as shown m figure 13 


8 
2 
5 I 3 
11 
9 
1 
12 
4 
7 
6 
10 


- 
- 
--- 
- 
------ - 
- 
- 
- 


A 
1 
- 
- 
-------- - 
----- 
-- - 
DEF 
DEF 
I 
OHi 
OHi 


2 
3 -1- 


4 
- 
- 
- 
-- 
- 
- 
- 
JKL 
N 
MN 
' 
5 
6 
- 
- 
------- 
--- 
- 
- 
- 
- 


0 
7 
- 
- 
- 
------------ - 
- 
- 


PRS 
PRS 
s 
8 
9 
10 


- 
- 
-- - 
----- ----- 
- 
- 
T 
T 
11 
I 
12 


FIGURE 13 


The word PENETRATIONS will fit and it rs taken to be presumably correct 
There is no absolute 
certarnty about the matter, for it is conceivable and possible that there are other words which 
can be made to fit the sequence of key numbers given 


15 Alternative method of solution -a The foregomg solut10n will no doubt appeal to the 
student as bemg straightforward and srmple-if the original assumption as to the undth of the 
transposition rectangle is correct 
But, unfortunately, there is no way of knowrng whether such 


an or1gmal assumpt10n IS correct until solut10n is well under way 
In practice, of course, what 
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might be done w1tlnn a well-orgamzed cryptanalytic umt would be to divide up the work among 
the mdiv1duals const1tutmg the umt, each bemg assigned one or more specific hypotheses to try 
out with respect to width of rectangle 
Then one of these md1v1duals would find the correct 


width and he would bl' JOmC'd by the otlu•rs ns soon as an entC'rmg wedge had been found m this 
way 
Of, if the c1yptanaly..,t iq workmg alone, he must try out qucce..,s1ve hypotheses ai,, to 


width of rectangle until he hits upon the correct one 
In makmg these hypothei,,es he must be 
gmded by prev10us e"!Cper1enrn with enemy wrreqpondcn(,e, wh1(,h may a.ffmd clue<; Rb to mnnmum 
and maximum widths of re< t.inglcs 


b Howt>vm, there lb another methoJ of aiLdGk winch does not llC'Cebs1tate makmg any 
dehmte m1trnl assumptions with respect to the width of the transposition rectangle 
This method 


is a modificu t10n of the method s< t fo1 th m tlu.• pr ccedmg parngraph 
The te\.t of the c,rypto- 


gram is written out columnw1se on cro<;s-sect10n pape1, evl'ly hfth letter bemg numbPred for pur- 
poses of refe1ence 
Plenty of spac,e is left between the columns, and about 10 01 15 letters at the 
bottom of each wlumn arc r<'pcatcd at the top of tllC' next column so that at any pomt m thP 
trnnscr1pt1011 tlwrP '"'ill bP m a smglP unbrnh.<'n strmg at least one wmpletc column of lPttcrs from 
the tran'!poi,,1i10n rectangle 
Then a &<'Chon of consecutive letteis of text is written on a separate 


&tnp of cross-sect10n paper, columnw1be of course, and by JUXtaposmg this strip agamst the whole 
text, shdmg it to vauous pomts of <0mudcnrn agamst the text, an attempt is madC' to find that 
pos1t10n m \\Inch the hPst d1grnphs RIP fmmPd of thP letter& on the movablP stup and the fi'Ced 
sequence 
Of course, if there is a Q m the cryptogram, the shdmg-stnp section is made to con tam 


th1q letter, and thP stnp is then placed agamst the text where a U is found, so as to form the digraph 
QU 
The digraphs formed above and bPlow the QU a1e then studied, possibly a wntten record is 


made of the d1grnphs found 
Then the "lame tlung Ib done with the Q and all other U's m the 
text, to msm c that a correct stai t is made 
It 1s this m1tial step which is likely to give the most 
difficulty (1f there 1s anythmg d1ffiwlt at all m the prncedure) and it is important that it be cor- 
rect 
If thib fubt qtep ii,, eaby, then .. olut10n follow& qmte rapidly, if the cryptanalyst is unlucky 
and makes seveial false starts, thP procesi,, 1s hkely to be a slow one 
In choosmg from among 
several possible JUxtapoi,,1t1ons it may be advisable to calculate the probability value of each 
poss1bil1ty by addmg the logar1thmq of the frequPncy valueq of the digraphs, as explamed m 
paragraph 7q In the absC'nce of any Q's m the te:ll..t, rewurse must be had to the fo1mat1on of 
other probable digraphs, based upon the presence of (,ertam other telltale low-frequency letter&, 
such as C, H, J, K, V, and X 
The cryptanalyst is fortunatP if ther<' are two or three of these low- 
frequency letters close to one another m a seues of letters, for m th1., case he can search for a 
place where there are high-frequency letters (m a correspondmg sequence) that might be com- 
bmed with them 
For e:li..ample, suppose that a t<''l.t shows a sequen(,e 
V E H H K 
A &equence such as 
A R T C C 
would bP excPllent to try, for it will ywld the d1grnhhs 
AV, RE, TH, CH, CK 
Or if there is a long sequence of consonants, the cryptanalyst should 
look for a cmrespondmgly long sequence of vowels, smce these make the best combmat1ons and 
are therefo1e most probable 
For thPse reasons it pays to study the text qmtc carefully bcfo1e 
choosmg a startmg pomt, to find all such peculiar sequences as might be useful m afiordmg a 
good pomt of departure 
It should also be noted that there are at least two correct pos1t1ons at 


which the shdmg stnp can be iuxtaposC'd agamst the text, smce m the enmphermg rectangle the 
letters m one column form d1graphq with the letters m the column not only on the right hut also 
on the left 
In the abscme of any Q's, or othn low-frequpnc,y letters smtable for a pomt of depar- 
ture, the very fust 20 or 25 lettPrs of the cryptogram may be used as the startmg pomt, smce 
these letters come from column 1 of the transpos1t10n rectangle and therefore there is no uncer- 
tamty at least as to the letter which is at the top of that column, or, the last 20 or 25 letters of 
the cryptogram may be used as the sta1 tmg pomt, sm(,e these letters come from the last-num- 


1 


¥ 
L 
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bered wlumn of the rec,tangle and therefore there is no uncertamty at least as to the letter which 
1s at the bottom of that column 
c Suppose that a good m1tml JUxtapos1hon has been found for the port10n of the text that 
has been written on the "lhdmg stnp, and that a senes of e"\.cellent digraphs has been brought to 
hght 
The nC'"\.t step 1q1 of com..,e, to udd to thc'!e d1?:I"aphs on e1thC'r 
side by findmg i,,ections of tP'Ct that will ywld "good" tugrnphs and 
tetrngraphs 
F01 <''-clmplc, suppose th.it the nntial Jt1xtnpob1t1on bus 
yielded whut is shown m f1gmP 14 
TIU' chgrnph PR suggtsts thut it 


mt.st b<' followed by a \01\cl, prdciably E, A, or 0, th<• d1g1.tph AV 
might be pmt of tho word CAVALRY, m winch u1se it \\Ill be follo,Hd 
Ly A, the d1e-rnph CR suggcstb that it m1gl1t b<' followed by the Yo,,cl 
A or E 
A plac,c 1s therefore sought, m the rnst of the te,.t, whPI<' 


there 1q a SC'quence of th<' lcttc1 '! he1 c d<''!ll ed, and, of cour~e, at tlie 
proper inforwl~ 
Suppose "luch a spqueme is found and )'lekb \\hat ii,, 


shown m f1~uJC 15 
The skeletons of "ouJ., arc now b<>gmnmg to 
appea1 
As'!ummg that AV A I'> rndecd part of the w01d CAVALRY, 


theH' .,}10uld be an L to follo" it, tlw trig111ph T I N su~gcsts the tPr- 
mmat10n G, the tugrnph Z ER bUggestb the woul ZERO 
A sect1011 of 
text is theiefoie &ought, wh1<h "'ill have the lette1s L, G, and O m thP 


1 2 3 4 6 
1 2 
order L 
G 
0 
Enough has been .,hown to demonstrate 
the proccdme 
In thP comse of th<• wmk it qoon becomC's C'v1dent 


whe10 the ends of columns are, hccaust> tlw digraph& above and belo\\ 


RR 
NA 
p R 
T 0 
AV 
R E 
TH 
CH 
C K 
I L 
T I 
C R 
B E 
Z E 
EA 


the nudear 01 "good" portion become "bad" qmtc "luddeuh', JUst ,i., 
J 
lIGURE 14 
soon as letters belongmg to nonadJeccnt columns m tlw ougrnal rec- 


RR S 
NAT 
PRE 
T 0 R 
AV A 
RED 
TH R 
CHU 
C K A 
I L L 
T I N 
C R A 
B E S 
Z ER 
E A 0 


FIGURE 16 


tangle aie brought together 
.For e'Cample, m figure 15 it is obser\'ed that the tugraph at the 
top, R R S, is highly rmp10bable, as 1& hkew1se the tngraph at the bottom, E A O 
This suggests 
that these letters have been brought together erroneously, that is, that they do not belong m 
adJacent columns m the enmphermg rectangle 
If this is true then the "good" port10n 18 com- 
posed of the 13 letteN bet'\\-ccn these two e:ll..trem1tws and therefore the columns are about 13 
letter& long 
.Add1t10nal wmk will soon show eJi.actly how long rnch column really is, and when 


this has hPen ascertamed the problem has b<'Pn prnct1cally completed, smcc at the <:ame trme 
that this becomes evulent the '>equence of colnmn"l hab al..,o become evident 
d An example of solut10n by tins alternative method may be helpful 
Ui,,mg the c1ypto- 


grnm of paragraph 13 as an Pxample, hgme J 6 sho\\ show the text might be transcribed on a sheet 
of cross-i,,ect10n pnper 
Notmg that the m<'ssagc contams a Q as the 129th letter, a sC'ction of 
text to mclude the Q is transcribed on a stnp of cross-sect10n paper and th1i,, stnp is then Juxta- 
posed agamst the remammg tP~t to brmg the Q m front of a U 
How many lett<>rs should be 
mclurled m this strip? The mesbage con tams 224 letters, if a width of say 10 to 20 columns is 
assumed, the columns of the re( tangle will be about 12 to 22 letters m length 
It will be safer to 
assume a convement length closm to the maximum than to the mm1mum 1 conbequently a length 
of 20 lettC'rs will be tentut1vely assumed 
Now the Qmay be at the top of a column, at the middle, 
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1 
2 
3 
4 


0 
OT 28 
OF u1 
OE 111 
0 I 
D a1 
M 01 
F 01 
T 121 
Em 
A ls1 
A 211 
110 R 
110 RM 
110 RM 
110 RE 
D 
s 
s 
M 
N 
A 
E 
L 
u 
UE 80 
UB 
UA 
N 
T 
c 
B 
D 
0 
N 
0 
I 
M 
MD 
MI 
ML 180 
N 
E 
L 
I 
A 
0 
E 
D 
~ 
E 
ES 
EE 96 
EA 
p li 
0 85 
c 65 
E 96 
H w 
T 155 
E 1ss 
I 
216 
T 
TT 
TH 
TE 
T 
I 
s 
H 
I 
H 
M 
R 
llli y 
11s YE 
115 YB 
m YN 
I 
T 
0 
B 
R 
E 
y 
0 
0 
00 35 
ov 
OE 
R 
D 
E 
v 
H 
A 
T 
R 
IO 1 
II 
IT 
IE ™ 
N 
M 
F 
T 
Q 
c 
F 
y 
KO 
KT 
KB loo 
KM 
T lo 
A 40 
c 70 
B loo 
I 130 
N 100 
I 190 
N 220 
NN 
ND 
NE 
NY 
D 
N 
F 
E 
E 
s 
T 
N 
120 KN 
120 KM 
120 KS 
120 KT 
T 
L 
F 
s 
T 
H 
A 
R 
TP 5 
TA 40 
TR 
TF 
u 
N 
T 
R 
E 
E 
N 
G 
NT 
NN 
NS 
NI 100 


R 
0 
E 
s 
T 
E 
L 
y 
DI 
DL 
DY 1Dli 
DT 
0 lli 
E45 
E 75 
y 105 
N 135 
v 1115 
N 195 
AR 
AN 
AL 
AA 
E 
B 
E 
L 
0 
T 
N 
1211 HN 
1211 HO 
1211 HX 
1211 HN 
x 
0 
M 
x 
T 
R 
u 
IT 10 
IE 45 
IR 
IL 
A 
u 
I 
R 
R 
E 
A 
RD 
RB 
RO 
RN 195 


L 
H 
A 
0 
A 
s 
c 
HT 
HO 
HR 110 
HN 
N 20 
E 50 
I 80 
R 110 
A 140 
R 170 
L 200 
_ 
_. 


QU 
QU 
QU 
QU .._ 


I 
N 
T 
u 
v 
A 
R 
130 IR 
130 IH 
130 IM 
130 IA 
E 
L 
E 
M 
R 
I 
E 
EO ls 
EE 50 
EE 
EC 
T 
E 
A 
E 
I 
I 
N 
TE 
TN 
TT 
TL 200 
G 
s 
I 
T 
R 
E 
R 
EX 
EL 
EY l1li 
ER 
N z 
E 115 
J 85 
y 115 
s 145 
A 116 
T 2Dli 
TA 
TE 
TO 
TE 
w 
A 
N 
0 
T 
T 
R 
135 NL 
135 NS 
136 NI 
1311 NN 
T 
A 
s 
I 
G 
E 
A 
ON 20 
OE M 
OK 
OR 
T 
c 
0 
K 
s 
E 
T 
TI 
TA 
TN 
TT 205 


M 
T 
I 
N 
E 
A 
s 
RE; 
RA 
RK 120 
RR 
E ao 
R oo 
v 90 
K 120 
F loo 
L lso 
0 210 
AT 
AC 
AT 
AA 
D 
M 
F 
T 
E 
A 
A 
Ho AG 
140 AT 
140 AN 
140 AT 
s 
s 
M 
N 
A 
E 
L 
VN 2s 
VR 60 
VD 
vs 
T 
c 
B 
D 
0 
N 
0 
RW 
RM 
RA 
RO 210 
E 
L 
I 
A 
0 
E 
D 
IT 
IS 
IH 1211 
IA 
0 311 
c 115 
E 1111 
H 125 
T 155 
E 1ss 
I 2lli 
RT 
RC 
RI 
RL 
I 
s 
H 
I 
H 
M 
R 
145 SM 
146 SL 
1411 SR 
145 so 
T 
0 
B 
R 
E 
y 
0 
TE 30 
TC 66 
TH 
TD 
D 
E 
v 
H 
A 
T 
R 
GD 
GS 
GQ 
GI 215 


M 
F 
T 
Q 
c 
F 
y 
SS 
so 
SI 130 
SR 
A 40 
c 70 
B 100 
I 130 
N loo 
I 
190 
N a:o 
ET 
EE 
ET 
EO 
FIOUBJ: 16 
1 
2 
3 
4 


FmUBB 17-A 
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or at the bottom-there is no way of tellmg at this pomt 
Hence, to make sure that nothmg 


is overlooked, suppose a sect10n of 41 letters is taken, with the Q at the center 
There are 4 U's 


m the message, and 4 trials are to be made 
The results are as md1cated m figure 17-A Examm- 
mg wmbmat1on 1 m figure 17-A, the digraphs formed both above and below the Q U are not at all 


SIO 
CKD 
LNN 
CKN 
STP 
ONT 
EDI 
FAR 
CHN 
FIT 
FRO 
THT 


_. EQU 


EIR 
EEO 
MTE 
IEX 
ATA 
INL 
TON 
ETI 
ARE 
IAT 
JAG 


SOF 
ERM 
AUB 
AMI 
CEE 
TTH 
RYB 
MOV 
SIT 
CKB 
LNE 
CKS 
STR 
ONS 
EDY 
FAL 
CHX 
FIR 
FRO 
THR 
EQU 
EIM 
EEE 
MTT 
IEY 
ATO 
INI 
TOK 
ETN 
ARK 
IAT 
JAN 
3 


Fmu1u: 17-B 


bad 
In fact, not one of thosp above the Q U is 1mposs1ble and the same 


is true of thosl' below the Q U until thP digraph V N is renrhcd 
Hence, 
wmbmat1011 1 is possibh• 
As f01 wmbmation 2, this at onc.,l' appe11rs 


to be bud 
D1giaphs such as I I, and I H RI<' highly 1mprobablP, end 
tins rnmbmation muv be d1scardPd with •mfety 
Combmation ~ t'! 
possible from the top digraph, 0 F, to tlll' 12th digraph below the Q U, 
ulthough the digraph H X looks very bad 
Howl'ver, the X might be a 


'!PntPml' sl'parator, so that this combmat1on cannot be disceided 
Combmation 4 looks very improbable, with the digraph H N occurring 
t\\ice, nnd other equally bad digraph'! showmg 
Of the Iom possilnl- 


it1l'1> tllC'n, rnmbmations 2 and 4 are discardl•d, leavm~ l and J for 
fm tlw1 study 
It is 'e1y difficult to d1oose between these two possi- 
b1hties 
All the digraphs m lOmbmation 1 down to digraph V N are 
posi.1ble, manv of them are excl'llent 
As for combmat10n 3, all the 


d1in-aphs do\\n to VD arc also possible and many of them am cxrellent 
There does not seem to bl' much use to add thl' frequency values of the 
digraphs (or loganthms thereof) m ead1 combmation because it is hard 
to know with what digraphs to begm or end, although as a last resort 
this could of comse be done 
However, perhaps it is not essential that 
a clwice be made at once, possibl'I/ further work along ~he lines now to 
be demonstrated will show 'IJ'hich combination is correct 
Notmg the 2 K's (m thP digraphs KB and KS) among 
thl' rnmbmat1ons before the Q, assume that these K's are 
parts of the digiaph C K ls the1e a s<'quencc C 
C m 
the text? There is but one sud1 place, at the 63d letter 
Suppose thl' roriespondmg '!<'ctlon is placed m front ot 
the combmat1ons 1 and 3 of figure 17, as shown m figure 
17-B 
It immedmtely bl'comcs evident that combma- 


t10n 3 is the wuect one, fm note the excellent tr1- 
graphs 1t gives, as rompaied with those m combmat10n 
1 Also note that the second trigraph below the E Q U 
Ill combmation 3 consists of 3 E's, md1rntmg that the 
end of the columns has been rcachl'd JU'!t before tln"I 
tr1graph 
As foi the top tngraphs of figme 17-B they 


are good all the way up 
But now the skeletons of 


word& a1 e begmnmg to appear 
The T H R 1mmed1ately above the E Q U sug- 


gest<~ Pither THREE or THROUGH, the FR 0 abovl' the T H R suggl'sts FROM or 
FRONT 
Suppose the word REQUEST is assumed f01 the E Q U, and thl' \\Ord 


THREE is assumed for the T H R above it 
ThIS rcqmres a section with 2 E's m 


SUCCl'bSIOn 


SOFV 
ERMT 
AUBR 
AMIE 
CEES 
TTHR 
RYBA 
MOVI 
SIT! 
CKBE 
LNEA 
CKST 
STRE 
ONSE 
EDYA 
FALL 
CHXA 
FIRE 
FRON 
THRE 
EQUE 
EIMM 
EEEY 


e There are sevl'ral such places m thr text, and further hm1tat1on is advisable 


The 8th tngraph from the top is certamly suggestive of the wmd MOVING, whwh 
reqmres an I to follow the V 
Is there a place m the text where an I occurs 12 
letters before a succession of two E's? There is one e.uch place, and the corres- 
pondmg section is JUXtaposed at the proper place, yieldmg what is shown m 
FIGUBI: 17-C 
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bgure 17-C 
The upper and lower hmits of the columns are now fairly defimte and are 
marked by the horu.:ontal bars, tetragraphs EE E Y at the bottom and A M I E at the top 
are very improbable 
The :tetragraph C E E S below the top bar is possible, because it may 
represent the end of a word hke FORCE followed by the begmrung of the word ESTIMATED, the 
tetragraph above the bottom bar suggests a word endmg m E followed by the word IMMEDIATE 
It seems hardly necessary to contmue with the demonstration, m a few moments the entire 
diagram is ieconstructed and yield& the solut10n 
During this process as soon as a sect10n of 
text m figure 16 has been used it is crossed off, so as to prevent its letters from bemg considered 
as further posSibihties for addit10n to the reconstruction diagram 
Thus, as the work progressei. 


the number of available sections becomes progressively less, and the chmce for successive sections 
for addition to the diagram becomes a qmte easy matter 
f When two or three operators are asSigiied to work upon a cryptogram by this method, 


solution can be reached ma very short space of trme, espemally if each one of the operators takl's a 
different pomt of attack 
After a few mmutes the fraginents of texts obtamed may be assun- 


Ilated mto one message which is then completed very speedily 


g This and the next four subparagraphs will be devoted to some remarks of a general natm e 
concerning columnar transposition of the forl'g01ng type 
The degree of cryptographic security 


afforded by srmple columnar transposition methods, especially when mcompletely-filled ma- 
trices are employed, is considerably mcreased if some of the cells of the matnx are occupied by 
nulls mstead of sigmficant letters If nulls are employed Judiciously their presence serves to 
confuse the cryptanalyst by mtroducmg unusual digraphs, tngraphs, and polygraphs whieh 
may lead him to discard correct combmations of columns m the anagramming process and thus 
retard solut10n 
Obviously, the use of low-frequency letters sueh as J, Q, X, or Z as nulls does 
not commend itself for this purpose, as such letters would not only distort the normal frequency 
distnbution and thus give clues to the presence of nulls, but also they would be qmckly 
"spotted" m the anagramming process 
h Another subterfuge, and a good one, to put stumbling blocks m the way of a qmck 
solution is to leave "blanks" w1thm the transposition matnx, that is, certam cells are left un- 
occupied by letters of the text If only a few cells distnbuted irregularly within the columns 
of the transposition matrix are designated as blanks, the dISturbing effect upon the anagram- 
mmg process is qmte marked 
This more or less effectively hmders the cryptanalyst m his 


attempts to asc.,ertam the lengths of the columns and considerably mcreases the difficulty of 
the anagi ammmg process 


i In order to fix defimtely the positions of the nulls or of the blanks m the transposition 
mat1ix, dcfimtc prearrangements between correspondents are necessary These may be m the 
nature of "forms" outhnmg the matru.., showing the number of columns and the positions of the 
cells to be occupied by nulls, or of the cells to be left vacant m the mscnption process, or the 
positions of these cells may be denved from the elements of the transposition key itself If 
"forms" are l'mployed, they may be used with varying transposit10n keys, so that even though 
there may be only relatively few different forms, the use of varymg transposition keys serves to 
mcrcase cryptographic sewnty to a rather marked degree 


J If nulls, or blanks, or both, are distnbuted irregularly but symmetrically throughout the 


transposit10n matrix (as, for example, blanks are distnbuted m cross-word puzzles) solution 
of smgle messages procluced by srmple keyed-columnar transposition from such a matux 
becomes an extremely difficult if not impossible problem 
Naturally, if nulls and blanks are 
dIStr1buted irregularly and assymmetncally the matter becomes hopeless, as far as a smgle 
message is concerned 


k Of course, if several messages of identical length and m the same key are available for 
supenmposition, the presence of the nulls or blanks then makes little difference, because the 


,,, ' 


general solution to be explamed ma subsequent paragraph (par 26) can be applied 
Or if mes- 
sages with similar begmnmgs or similar endmgs are available, solution is facilitated here as m the 
simpler case where nulls or blanks are not employed, as will be explamcd m subsequent para- 
graphs (pars 23-24) 
Considerations of space prevent gomg mto detail m the solution of an 
example, and the student should undertake a study of these cases for himself 
l'i' 
16 The C-+P and the P-+C sequences-a Two numencal sequences which constitute the 
bases for several very important cryptanalytic operations and proredures ID the solution of 
transposition riphers may be denved from, and are applicable to, most ciphers of this class 
They 
are as follows 
(1) A sequence the successive terms of which mdicate the position numbers that the 
successive letters of the plam text occupy ID the cipher text 
This sequence will heremafter be 
designated the plai~cipker sequence, or P-+O sequence 
(2) A sequence the successive terms of which IDdica.te the position numbers that the 
surcessive letters of the cipher text occupy m the plam text 
This sequence will herema.fter be 


designated thP ciphe~plain sequence, or 0-+P sequence 
b These two sequences a.re obviously related, one beIDg the ini erse or mdexed version of the 
other 
Given one of the sequences, the other can be derived from it by the simple operation of 


mde'tmg, m a normal sequence, the positions occupied by the numbers constitutmg the sequence 
on hand 
An eumple will be given presently 
c Note the encipherment shown m Figure 18-A 
T R A N S P 0 S I T I 0 N 
12 9 
l 
4 
10 
8 
6 
11 
2 13 
3 
7 
5 
T H E Q U I C K B R 0 W N 
F 0 X J U M P S 0 V E R T 
HELAZYDOG 


Term No 
l 
2 
3 
4 
5 
6 
7 
8 
9 10 11 12 13 14 15 16 17 18 19 31 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 


Cipher E X L B 0 G 0 E Q J A N T C P D W R I M Y H 0 E U U Z K S 0 T F H R V 


Fmvu 18-A 


Now, if, mstead of letters, the successive numbers 1, 2, 3, 
are IDscnbed ID the cells of the 
matnx, m normal order of writmg, the "cipher text" becomes the P-+C sequence and is as 
follows 
12 9 1 4 10 8 6 11 
2 13 3 7 5 


01 02 03 04 05 06 07 08 09 10 11 12 13 
14 15 16 17 18 19 20 21 22 23 24 25 26 
27 28 29 30 31 32 33 34 35 


Term number. 
_ 
_ 
1 
2 
a 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
31 
P-+C equences _______ 03 16 29 09 22 35 11 24 04 17 30 13 26 07 20 33 12 25 06 19 


n 
22 
23 
24 
25 
26 
27 
28 
29 
30 
M 
~ 33 
M 
U 


32 02 15 28 05 18 31 08 21 34 01 14 27 10 23 


FIGUBll: 18-B 


The stu<lent may easily verify that the P-+C sequence is what it purports to be by notmg that, 
accordIDg to it, the 1st letter of the plam text of the illustrative message, Tp, becomes the 31st 
letter of the cipher text (smce the number 01 occupies position 31 m the P-+C sequence shown 
above), and that m the cryptogram the 31st letter is T0 , the 2d letter of the plam text, Hp, becomes 
the 22d letter of the cipher text and that m the cryptogram the 22d letter is H0 , and so on 
In 
connection with the P-+C sequence, it is to be noted that successive terms m the sequence, 


33 


m the case of smgle transposition, show a constant difference except when pa.ssmg from a greater 
to a smaller number, which happens every trme a transition is made from a term applymg to 
the bottom element of one column to a term applymg to the top element of the next column 
For example, m the case of the 1st three terms m the sequence 16-03=13, 29-16=13 
However, m the case of the 3d term of the sequence (29) and the 4th (09) the passage i& from 
a greater to a smaller number and the constant differenre, 13, no longer 1., evident 
ThP cause of 
the constant difference is, of course, obvious and follows directly from the merhamcs of the trans- 
position system itself 
The pomt to be specic:1.lly noted 1.., that the eJ<.istence of '>nch a ronstant 


difference (with the exceptions noted above) may be taken as one of the identifymg characteristirs 
of smgle columnar transposition, double columnar transposition or other types of complex trans- 
position will show no such constant difference throughout the P-+C sequence 
d Given the P-+C sequence m subparagraph c, its mverse, the C-+P sequence is established 


merely by prepa.nng an mdexed version of the former 
Thus 
Tenn number 
_ _ _ __ _ ___ _ __ 
01 
02 
03 
04 
05 
06 
07 
08 
Oii 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
2tl 
P-+C sequence ___________ 03 16 29 09 22 35 11 24 04 17 30 13 26 07 20 33 12 25 06 19 


~ 22 
23 
24 
25 
26 
27 
28 
29 
30 
n 
~ 33 
M 
M 


32 02 15 28 05 18 31 08 21 34 01 14 27 10 23 


Term number _ -------- ____ _ 
01 
02 
03 
04 
05 
06 
07 
08 
Oii 
10 
11 
12 
13 
H 
15 
16 
17 
18 
19 
20 
C-+P sequence _________ 31 22 01 09 25 19 14 28 04 34 07 17 12 32 23 02 10 26 20 15 


" 
22 
23 
24 
25 
26 
27 
28 
29 
30 
M 
~ 33 
M 
U 


29 05 35 08 18 13 33 24 03 11 27 21 16 30 06 


e The C-+P sequence can also be p1oduced m another way 
Suppose that numbers are 


mscnbed m the cells of the transposition matnx, not m the normal manner of writmg from left to 
nght and form the top downward, but a.ccordmg to the route followed m transcribing the numbers 
to form the "cipher text," that is, m key-number order m the columns of the matnx 
Thus 


12 9 1 4 10 8 6 11 
2 13 3 7 5 
31 22 01 09 25 19 14 28 04 34 07 17 12 
32 23 02 10 26 20 15 29 05 35 08 18 13 
33 24 03 11 27 21 16 30 06 


FIGUBll18-C 


If these numbers a.re now transcnbed a.ccordmg to the normal manner of wnting (from left to 
nght and from the top downward), the sequence produced is 31 22 01 09 25 
, which com- 
c1des with the C-+P sequence shown m subparagraph d above, which m turn was derived from the 
P-+C sequence 
Term number 
01 
02 
03 
04 
05 
06 
07 
08 
Oii 
10 
11 
12 
13 
H 
16 
16 
17 
18 
19 
20 
C-+P sequence ____________ 31 22 01 09 25 19 14 28 04 34 07 17 12 32 23 02 10 26 20 15 


n 
22 
23 
24 
~ ~ 27 
28 
29 
M 
M 
~ 33 
M 
M 


29 05 35 08 18 13 33 24 03 11 27 21 16 30 06 


j The C-+P sequence may also be called the anagram sequence because it can be established 
as a rel:lult of a. solution accomplished by anagrammmg superimposed messages of identical length 
It is clear that what is accomplished m such a solution is to rearrange the letters of the cipher 
text to bnng them back mto their ongwa.l order m the cipher text, that IS, the solution mvolves a 
C-+P conversion 
g The P-+C sequence is called by a recent French author the KP sequence (from the Greek 
word /cryptos) because it gives the order of the plam-text le'tters as they occur m the cryptogram 
The P-+C sequence is also termed the encipher sequence by another wnter, and still another has 
called it the transposition sequence 
The present author behaves that the termmology adopted 
herem, viz, P-+C sequence and C-+P sequence, is less confusmg and serves more accurately to 
identify or cha.ractenze these sequences than the other designations herem mdicated 
L 


34 


h The term number is useful merely to facilitate findmg and referrmg to specific terms or 
numbers m a sequence, whether the latter be a C--+P or a P--+C sequence 
The number simply 
mdicates the locus or position a term occupies m the sequence 
In connection with a plain- 


text message the consecutive term numbers 1, 2, 3, 
may be used as loCI for the successive 
letters of the message, m connection with a cryptogram the conc:iecut1ve term numbe1s 1, 2, 3, 
may be used as loCI for the successive lette1s of the cipher text 


i In single, keyed-columnar transposition an mterestmg relationship exists between sections 
of the C--+P sequence 
Consider the c~p sequence given m subparagraph d above, and note 
that by addmg the integer 1 to the successive numbers thereof, sections of the ongmal sequence 
show certam identities with sections m C--+P c:iequence + 1 
Thus 


Term number - - 
- 
- 
-- 
1 
2 
3 
4 
5 
6 
7 
8 
9 
JO 
11 
12 
n 
14 
15 
16 
17 
18 
19 
20 
21 
22 


C--+P sequence _______ 31 22 01 09 25 19 14 28 04 34 07 17 12 32 23 02 10 26 20 15 29 05 
C--+Psequence+L_ 32 23 02 10 26 20 15 29 05 35 08 18 13 33 24 03 11 27 21 16 30 06 


~ U 
~ ~ ~ ~ ~ ~ M 
~ ~ M 
~ 


35 08 18 13 33 24 03 11 27 21 16 30 06 
36 09 19 14 34 25 04 12 28 22 17 31 07 


In fact, if the successive numbers of the c~P sequence are set down m rows to produce sequent 
numbers m columns, the followmg mterestrng diagram is obtamed 


31 22 01 09 25 19 14 28 04 34 07 17 12 
+1 32 23 02 10 26 20 15 29 05 35 08 18 13 
+1 33 24 03 11 27 21 16 30 06 


FIGUBB 18-D 


Reference to b.gure 18-C will show the identity of this die.gram with that figure 
Such an 
arrangement of course mdicates at once the number of columns m the transposition rectangle, 
from wluch it follows that if the C--+P sequence is available it is an easy matter to establish the 
outlines of the transposition matnx 
The phenomena dealt with m tlus subparagraph are but 
a reflection of those discussed m subparagraph c above 


J The phenomena JUst mdicated may, however, be employed to advantage m another 
manner m the solution of an unknown example 
Referrmg to the illustrative c1yptogra.m m 
subparagraph c above, suppose that the cryptanalyst has reason to suspect the presence of the 
probable word QUICK 
The letters necessary to produce tlus word (and their term numbers m 
the cryptogram) are as follo'\\-s 


2~ 


9 
26 
19 
u 
28 


Q U I 
C K 


The sequence 9-~~-19-14-28 now constitutes a portion of thP C--+P sequence 
Addmg the 
mteger 1 successively to these C--+P numbers, let the cmrcspondmg letters be set down along- 
Slde the numbers 
Thus 
25 
Base___________________ 
9 
26 
19 
14 
28 
- 
Q U 
I 
C K 


35 


Here it will be seen that portions of "good" plam text become manifest, viz, JUMPS and AZYDO 
The 3d denvative no longer is "good" because the rectangle has but 3 rows u.nd consequently 
only the 1st and 2d denvatives from the "base" are vahd 
It is obvious that the foregomg 
method of denvmg plam-text sections from a correct probable word offers con<nderable possi- 
bilities as a cryptanalytic tool, especially m the case of matriceb with more than 2 or 3 rows 
If 
sections of text can be reconstructed m this manner and then comhmed m proppr c:ipquPnce the 
reconstruction of the complete matrix and the tmnqpoc:i1t1on key 1-. .t rPlahvPly simplP matter 
The application of the foregomg prmc1plc> to the .. olut1on of unknown e'\.ampl0 c:i 1c:i, of course, 
obvious 


k There is also an mterestmg relat1onslup between the sections of the P--+C sequence for a 


cryptogram, though it is somewhat different from that d1scuc:ised 1s subparagraphs i and I m thP 
case of the C--+P sequence 
Consider the P--+C sequence set forth m subparagraph d above Bnd 


note how, by addmg the mteger 1 to the successive numbers, sections of the P--+C sequence become 
identical with sections of the P--+C+l sequence 
Thus 


P--+C sequence ___________ 03 16 29 09 22 35 11 24 04 17 30 13 26 07 20 33 12 25 


I 
2 
~ 4 
5 
-0....,-- 
06 19 32 02 15 28 05 18 31 08 21 34 01 14 27 10 23 
8 
10 
II 


P--+Csequence+L ___ 04 17 30 10 23 36 12 25 05 18 31 14 27 08 21 34 13 26 07 


I -4 
-r.:ir 
""'d='7 
4=10 
"'5:'i2 
6-11 
7 - ~ 
20 33 03 16 29 06 19 32 09 22 35 02 15 28 11 24 
'"""8-1i' 
D=l 
10-8 
11-2 
u~9 
13:3 


The eqwvalenCies between identities, as mdicated above, mdicate not only that the enc1phenng 
matnx has 13 columns, but also they may be used to establish the actual transposition key or 
at least a cyclic permutation of the key, by constrnctmg a cham of eqmvalents 
Thus 
1=4, 4=10, 10=8, 8=6, 6=11, 11=2, 2=13, 1'3=3, 3=7, 7=5, 5=12, 12=9, 9=1 


Tlus yields, by ehmmatmg the term common to successive equivalents, the followmg cham or 
tnmsposition key 
1 4 10 8 6 11 
2 13 3 7 5 12 9 
Reference to figure 18-A will show that the foregoing key 1s a cychc permutation of the actual key 


l There remam only some mmor remarks which, bemg of a general nature ansmg from the 


mechanics of srmple keyed-columnar transposition, are worth notmg 
They are discussed m the 
subsequent two subparagraphs 
m An appreciation of the difficulties mtroduced by employmg only incompletely-filled 
recte.ngles mdicates that it would be very useful if there were some method whereby m the initial 
stages of solution the cipher text could be divided up correctly mto its component long and short 
columns, for the subsequent steps of rearrangmg the columns by the anagrammmg prmmple are 
quite simple 
If, for example, there were some feature which provided a means of ascertammg 
when m encipherment a transit was made from the bottom of one column to the top of the next 
column, then the location of these transit10n pomts or "breaks" would obviously permit of break- 
mg up the cipher text mto its correct long and short columns 
In later studie1> cases of this kmd 
WJ.11 be encountered 
n It is useful sometimes to be able to ascertam JUSt where breaks cannot occur, that is, 


where a. passage from the bottom of one column to the top of the next one cannot occur m the 
cipher text, for this will hmit the field for experiment 
A consideration of the mechamcs of the 


system will afford a.n excellent clue to the fact that this determmation is easy to make 
In any 


transposition rectangle mvolvmg simple keyed-columnar transposition the mterval, m the cipher 
text, between two consecutive letters wluch are m the so.me row m the matnx is the sum of a. 


36 


multiple of the length of the short columns and a multiple of the length of the long columns 
Fm 


example, consider the adJacent letters CK m the plam-text rectangle m figure 18-A In the cipher 
C.1s the 14th letter, K. is the 28th and the mterval is 28-14=14 
The message has a total of 


35 letters and the matl'lX has 13 columns, 9 long ones of 3 letters and 4 short ones of 2 letters 
An mterval of 14 can therefore be brought about m only one way (4X3) + (1 X2)=14, which 
means that 4 long columns and 1 short one mtervene between the C and the K m the plam tc>xt 
and that the key numbers apphcable to the two columns are 5 apart m sequence, that 1s, if th~ 
column m which C is locatetl has key number 1, the column next to it on the right 1s 6, or 1f the 
former is 2 the latter is 7, u.Pd so on 
Refeience to figure 18-A will show that these deductions 


are correct and that the key numbers mvolved are 6-11 
However, a more general treatment is 


possible 
Given a cryptogram of 26 letters and an assumea 


width of 6 c~lumn~, for example, the matrix can have only 2 
columns of 5 letters and 4 columns of 4 letters Settmg down 
the multiples of the two lengths m tabular f01m, for conven- 
ience, the followmg 1s obtamed 


1 
2 
3 
4 
5 
6 
7 
8 
9 10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 26 I 


5 
4 


0 
multiple_____ _________ 
O 
O 


1st multiple______ ____ ___ 
5 
4 
2d multiple___________ _ _ 10 
8 
3d multiple _______________ - 
12 
4th multiple _______________ - 
lb 


All the possible pos1t1ons of breaks m the cipher te>..t, that is, tians1ts from the bottom of one 
column to th<' top of the next column, may now readily be ascertamed by findmg the totals result- 
mg from making all the possible combmat1ons of the md1cated multiples taken m pairs 
It is 


convement to draw up a table to show directly the sumc;; of the combmat1ons 
Thus 


No ol 
long col 
umns 


Length 


JD 
letters 
0 
0 


1 
5 


2 
10 


0 
1 
2 
3 
4. -- - -No ol short columns 


0 
4 
8 
12 
16 
-- -Length m letters 
--- 


0 
4 
8 
12 
16 
------ 
5 
9 
13 
17 
21 
-- 


10 
14 
18 
22 
26 


If, now, diagonal Imes are di awn from the lo"Wer left-hand corner to the upper right-hand corner 
of the diagram, the locat10ns of all possible breaks are given 
Thus, there can be a break be- 
tween the 4th and 5th letters (passmg f10m a short column to the next column, which may be 
long or short, of course), there cannot be a break between the 5th and 6th letters nor between 
the 6th and 7th, nor between the 7th and 8th, there can be a break between the 8th and 9th as 
well as between the 9th and 10th, but not between the 10th and 11th, and so on 
Suppose that 
for one reason or another the cryptanalyst has good reason to suspect that a break occurs imme- 
diately after the 13th letter 
This means that there are 2 short columns (of 4 letters) and 1 long 
column (of 5 letters) up to that break 
The diagram shows that there remam only 2 short 
columns and 1 long one, and the only breaks that are possible beyond the one at the 13th letter 
are Between the 17th and 18th, or between the 21st and 22d letters 
o The importance of the various prmc1ples set forth m this paragraph will become eVIdent as 
the student progresses m his studies of transposition mpherc;; 


SECTION IV 


OPPORTUNITIES AFFORDED BY STUDYING ERRORS AND BLUNDERS MADE BY 
ENEMY CRYPTOGRAPHERS 


Importance of the study of errors and blunder'! m early work upon an unknown 'l)"1tc..m 
S1gmficance of term'! "'!!pec1al solution" and "general <1olut10n" 
_ 


Example'!! to be bt11d1ed _ 


Paragraph 


17 
-- --- 
18 
-- ------ 
19 


17 Importance of the study of errors and blunders in early work upon an unknown 
system --a Blunders and nnstakes made by cryptographic clerks m the execution of cryp- 
tographic clerks m the execution of cryptographic mstruct10ns should be rare m a well-tramed and 
well-disc1plmed cryptographic sernce 
Nevertheless, blunders and mistakes are committed 
despite all that can be done to prevent their occU'ITence 
Especially m the excitement prior to 
or dunng an important action or movement do such mstances take place and these afford golden 
opportun1t1c>s for the enemy cryptanalytic serVIce 
This situation exists m respect to all types of 


cryptograp}n<., systems and no cryptanalytic mstruct1on would be complete if cogmzance were not 
taken of the advantages which may be 10aped from the blundt•rs, the mistakes, and, occaSionally, 
the downright meptitude of the adversary's cryptograph<'rs 
b Practically every cryptographic system affords opportumties foi the commu,s1011 of errors 


m its apphcat10n, and each system more or less presents a separate case That is, the en ors which 
may be made m one type of cryptographic system may be peculiar to that type alone and to no 
other type, hence, the astute cryptanalyst is constantly on the lookout for mstances of crypto- 
grams contammg the specific type of error by which that system is handicapped 
Furthermore, 
the general types of blunders or errors that may be committed are nearly as numerous as are the 
general types of cryptographic systems, so that no complete hst of such as may be encountered m 
practice can be drawn up 
c After the cryptanalyst has by pamstakmg and more or less arduous labors solved a system 
and has become thoroughly famtl1ar with its mechanics, he should carefully review the details of 
the mechamcs to learn what thmgs can go wrong, what sorts of mIStakes the enemy cryptographic 
personnel are hkely to make, and then study the external manifestations of these aberrations so that he 
may be able to recognize instances of their occurrence in subsequent cryptograms 
This sort of study 
has no value m itself particularly, its rmportance hes m the fact that the effects of erroneous 
treatment may lead to very rapid solution or to qmck recovery of keys to subsequent messages 
d When an unknown system is under mvestigat10n and the cryptanalyst is str1vmg to ascer- 


tam JUst how it operates (which is often the most difficult step m solution), a study of the crypto- 
grams representmg corrections to previous messages contammg errors is a most fruitful source of 
data 
Indeed, at times this sort of mtens1ve study will yield clues for solvmg a system which 
might otherwise resist all efforts to break it down for a very long time 


18 Sigmficance of terms "spemalsolutlon" and "general solution "--a Now the importance 
of the comments made m the foregomg paragraph wtll be clear if it is noted that a study of the 
blunders and errors often leads to the elaborat10n of methods for the rapid breakmg down of 
cryptographic systems 
But it must also be realized that m some cases no blunders or errors are 


essential to a rapid solution of the type alluded to above 
Sometimes the very mechanics of 


(37) 
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the system itself are suC'h that unavoidable or unpredictable C'ircumstanccs arise so that special 
solutions bcc..oml' possible 
The latter t1•rm calls for a bit of explanation 


b When the circumstanc,l's surroundmg a spl'cifk cryptogram or set of cryptograms ail' su<'h 


as to pr('sent peculiar or unusual conditions that makl' a solut10n possibll' whl'n m thl' absence of 
these <'onditions solution is eithPr impossible or rmp1obablP, thl' mPthods ('mployed m rPachmg a 
solution m such <'ascs constitut<' what is commonly t<•rmpd a special solution 
Some examples 
wtll be demonstratPd very soon 
SystPms of which tlns may b(' true arP, of coursl', cryptographi- 
c ally wPak but it may be ob<1<>1ved that it Is pC'lhaps 1mpoo:;s1bl<• to d<•v1s<' a sy<1tl'm wh1c,h m.ty be 
cons1d<'I I'd to be absolutely frl'e from tlns som ce of weakness 
c The advantages of a sp<'cial solution for any type of cryptographic system are, as a rule, 
two m number 
First, it oft<'l1 mak<•s a solution possible when otherwise this might not be the 


rnse 
Secondly, if often affordo:; a method of ach10vmg a vl'ry rapid solution m th<' case of a 


problem winch otherwise might reqmre a long time 
But a special solution presents one bns1c 
disadvantage It is by its very natur<' dependent upon the existence of unusual circumstances, m 
other words, upon chance or good fmtune brmgmg about a set of circumstances favorable for a 
<1olutio11 
Whl'n these unusual conditions or <'ircumstan<'e<1 do not obtam, then solution may be 


impossible 
Therefore, it is dl'sirable to havP, if possible, fo1 <'VPIY typP of system a mor1• or le<1s 


general solution which may bP appbed m the ab<1ence of the unusual rnnchhom. ll<'C'es .. ary fo1 th<' 
apphc,atton of a special solution 
In othPI words, a g<•nc•ral solution m <'iyptannlysis imphes a 


method or procedure which if applied 111 01dma1y casPs and undl'r nmmal conditions will yield 
the solution 
However, the tl'rm general solution m <'ryptanalysis must not be tak<'n too htnally 


The situation m <'ryptanalys1s is not exactly analogous to that which obtams m the field of pure 
mathematics, for the circumstances are often qmte chffl'r<'nt m the two scienC'es 
A general 
solution m matll<'mat1cs is expected to, and will, solve every case that falls withm its provmce, 
a general solution m cryptanalysis is likewise mtended to solve every case that falls w1thm its 
p1ovmce but this usually partakes more of the nature of a prayer or hope than an expectation 
Much depends upon the amount of traffic available for study, the length of mdividual crypto- 
grams, and the mdefinable element called luck, that is, a set of fortmtous circumstances which 
happen to make a solution easy or difficult, such as the presence of many or exceptionally long 
repetitions, etc 
Furthermore, whereas m mathematI< s a gPneral solut'lon presC'ribes the exact 
steps to be followed m arnvmg at the solution and the latter can be applied m all mstancPs 
without variation or deviation from a fixed procedure, m cryptanalysIS a general solution m<•rp)y 
outlmes a broad path that may be follow<>d m order to arnve at a solution 
Application of a 
general solution m cryptanalysis m specifi<' mstances may mvolve mmor detours to circumvent 
unexpected obstacles, or it may mvolve qmte large changes or modifications m the g<'nl'ral 
prom•dure 


19 Examples to be studied-a As stated above m paragraph 17, a complete hst of the 


specific blunders that cryptographic clerks are prone to perpetrate cannot be drawn up 
Cl'i tam 
of them may be descnbed m general terms and examples given of some which have already h<>Pn 
encountered m this and m precedmg t<>xts 
Commonly it 1s the case that these blunde1s do not 
become evident until two or more cryptograms are available for companson 
One of the most 
frequent sources of circumstances leadmg to the transmission of <'ryptograms affordmg ruh 
matenal for cryptanalytic companson is the following A cryptographic clerk prepar<'s a crypto- 
gram, m the course of which he makes a mistake of such a nature as to render the cryptogram 
difficult or impossible to decipher by the cryptographic clerk scrvmg the addressee 
A request 
for repetition ensues, whereupon the enciphenng clerk reexammes his ongmal work and finds that 
he has made armstake He then commits the grave blunder of reenc1phermg the identical message 
(without paraphrasmg) and transmittmg what to the enemy cryptanalysts is obviously a second 
I 


L 
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version of the origmal message 
The consequences are often fatal to cryptographic security 
The least that can happen is that the key for this partIC'ular message may be disclosed very 
qmckly, more senous, the basic or prrmary elements for the entire day's traffic may be wrested 
from the blunder, but most senous arc the consequences if it happens that the blund<>r has be<>n 
committed immediately or soon after a new cryptographic syst<>m has been mst1tuted and the 
enemy cryptanalysts are exertmg strenuous efforts to learn 1t1> mechamcs, for then is when th<' 
mformation to bP gam<>d io:; mo<1t valuablP 


b In ln~ previous studie1> the o:;tudC'lit hat> observed the many opportumties for qmck 
cryptanalytic success afforded by enemy addiction to the use of stereotypic phraseology, espe- 
cially at the begmmngs and endmgs of messages 
Stereotypic phraseology affords even more 
golden opportumties for cryptanalytic succeo:;o:; m the case of tran<ipos1t1on o:;ystems than it does 
m the case of substitution system .. 


c In the next few paragraphs some specific examples of the consequenc,es of <'ryptographic 


blunders and meptitude m the case of transposition systems will be studied 
These are mtended 
to give the student some idea of the far-reachmg effects such studies may have 
It is rmportant 
that he grasp the fundamental prmciples, for they will enable him to develop for himself the 
methods that he may find necessary m practical work 
Incidentally, it may be added that the 
student should not get the idea that these mstances are purely theoretical 
It is sometimes almost 


unbelievable that cryptographic clerks with any common sense would perpetrate the stupid 
blunders that they do occa.s1onally comm.it 


. I 
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SECTION v 


SPECIAL SOLUTIONS FOR TRANSPOSITION CIPHERS 


Solution when the bcgmmng or end of the plam text 1., known 
The cMc of an omitted column 
___ ---------- _ 
____ --- _ _ 
The case of an mterchanged pair of columns _ _ __ ------ _ _____ 
_ __ ------ _ ___ _ 
Messages with similar begmmnp;s 
_ _ _ _ ---- _ _ _ _ 
__ _ ------- 
-- _ 


Message'!! with similar endmgs 
__ _ _ _ ____ --------- _ _ 
The solution of a •nngle message contammg a long repet1t1on _ _ _ 
- - 
- - --- - 


Solution when several cryptogram., of 1dent1cal length and m the same key are available _____ _ 


Paragraph 
20 
21 
22 
23 
24 
25 
26 
27 
28 


Reconstruction of the keys m double transpos1t1on ------- _ __ __ 
______ __ __ __ 
__ _ _ __ _ 


Special cases of solution of double transpos1t1on ciphers ___ 
-- 
-- -- _ --- -- _ 


20 Solution when the beginmng or end of the pla.J.n text is known --a It often happens, 
when correspondents have fallen mto the bad habit of sendmg stereotyped eommumcat1ons, 
that the begmnmgs or the endmgs of messages become so fixed m then form and content that 
the enemy can with a fair degree of certamty gues'! what these will be m specific cases 
If so, 


a qmck solution can be reached, the key reconstructed for one message, and this will, of course, 
enable hun to read all other messages m the same key 
This is particulaily ti ue of srmple, 


keyed-colunma1-t1anspos1tion ciphers 
It is only necessary that the cryptanalyst cut. the text 
up m such a manner as to bnng the letters composmg the assumed text all wtthm the same row 
or rows of the transpos1t1on rectangle 
b Suppose that the enemy frequently uses the mtroductory e'\.pression REFERRING TO YOUR 


NUMBER 
Here is a cryptogram assumed to begm with this phrase 


I M A 0 D 
0 IR NW 
ER I AR 
EMEVG 


RMGRN 
T M 0 I S 
UH I AG 
T R I A F 


CRYPTOGRAM 
ER NIN 
0 I E G E 
P A U 0 0 
HT E PB 


T U S F S 
D H 0 P N 
S S S C I 
NB TN E 


D R Y E P 
CH L FU 
0 N RR E 
A EE TA 


B R C F T 
E S E P Q 
0 V 0 E Y 


c Assum.mg that prev10us expenence has md1cated that the enemy uses keys varymg 
from 10 to 20 letters m length, the arrangement of the letters m the tops of columns under a 
key length of 10 would be as shown m Fig 20 
12346678910 
R E F E R R I N G T 
OYOURNUMBE 
R 


FIGURE 20 


The first group of the cryptogram begms with I M The arrangement shown above gives I U 
as the top of a column, hence a key length of 10 is not c01rect 
A key length of 11 is then tried 


1 
2 
3 
4 
li 
6 
7 
8 
D ro ll 


R E F E R R I N G T 0 
YOURNUMBER 


FIGUU 21 


(40) 
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Here a column IS headed by I M, so that this IS a possible arrangement If the width of the 
rectangle is 11, its outlmes are as shown m figure 22 
There are 5 columns of 11 letters and 6 


R 
E 
F 
E 
R 
R 
I 
N 
G 
T 
0 


'------------------ ------ 
Y 0 
U R 
N U M B 
E 
R 
'--------------------- - -- - 
A 


'- ----------------- -- 


0 
,_ ___________________ _ 


D 
--------------------- 
R 
------------------- 
M 


'---------------------- 
G 
'- ------------------1- 
R 
--------------------1- 
N 


-------1---li-....:-~----....----........ 
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columns of 10 letters 
The text can now be marked off mto sections of proper lengths and, more- 


over, gmded by the letters which must be at the heads of columns, the text can be mscnbed m 
the rectangle m key order 
For example, column 1 must end with the second group, RM GR N, 
column 2 therefore begm.s with E R 
There IS only one possibility, viz, the fourth column 


This 1S a long column, and must therefore have 11 letters, ma.long column 3 begm with R Y 
ThIS defimtely fixes the pos1t1on of the number 3 m the key, and so on 
The solution IS reached 
af te1 only a very few moments and IS as shown m figure 23 


a 
e 
e 
2 
' 
1 
11 
5 
10 
8 


R 
E 
F 
E 
R 
R 
I 
N 
G 
T 
0 


- ------------------,_ 


y 
0 
u 
R 
N u 
M 
B 
E 
R s 
,__ ------------- 
------ 
E v 
E 
N w H 
A 
T 
D 
I 
s 
--------------------·- 
p 
0 s 
I 
T 
I 
0 
N 
H 
A s 
- 
------------------- 
B 
E 
E 
N 
M A 
D 
E 
0 
F c 
--------------------- 
R 
y 
p 
T 
0 
G 
R 
A 
p 
H 
I 


~ 
-- - 
-------------- - 
c 
E 
Q u 
I 
p 
M E 
N 
T 
0 
--------------------- 
F 
M 
E s s 
A 
G 
E c 
E 
N 
-------- ------------- 
T 
E 
R 
F 
0 
u 
R 
T 
H 
p 
R 
,__ ------------------ - 


0 
v 
I 
s 
I 
0 
N 
A 
L 
B 
R 


~ 
------ 
I 
G 
A 
D 
E 
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d The same general prinuples, modified to smt the cJ.rcumstances, may be followed m the 


case IDvolvmg known or suspected endmgs of messages 
The probable words are wntten out 
accordIDg to various assumed key lengths and the superrmposed letters fallIDg at the bottoms 
of columns are sought m the cryptogram 


21 The case of an oDUtted column -a Sometrmes a very careless clerk omits a column m 
transcnbmg the text from the enciphering rectangle and fatls to check the number of letters ID 
the final cryptogram Obviously such a cryptogram will be difficult If not rmposs1ble to decipher 
at the other end, and a repet1t1on IS requested and sent If now the identical plam text IS en- 
ciphered correctly, two cryptograms are at hand for comparison 
ThIS will d1Sclose the length 
of one column, which can be assumed to be either a long one or a short one The position, ID 
the correct cryptogram, of the column onntted from the mcorrect one will often afford direct 
clues as to the exact drmensions of the enciphering rectangle For example, suppose the crypto- 
gram ID paragraph 20b had first been transnntted as follows 


I M A 0 D 
I E G E D 
A U 0 0 S 
T E P B N 


RM GR N 
H 0 P N C 
S S C I 0 
BT NE A 


CRYPTOGRAM 


RYE PB 
H L FU E 
N RR E 0 
EE TA 


R C F T 0 
S E P Q E 
V 0 E Y E 


I R N W T 
RI AR U 
ME VG T 


M 0 I S 0 
H I A G P 
RI AF H 


b The column which was omitted IS E R N I N T U S F S D, and falls between columns 
1 and 3 Smee the omitted column contams 11 letters and column 1 contams 10, the dimensions 
of the rectangle rmmediately become known 
Thus, uncertamt1es as to the drmens1ons of the 
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rectangle are dissolved and a large step forward has been made m the solution 
Also, the 
general whereabouts of columns 1 and 2 are now known, smce the former IS a short one, the 
latter a long one 


22 The case of an interchanged p&ll' of columns -a The keymg element m the case of 
columnar transpos1t1on is srmply a practical means of controlling the order m which the columns 
of the enciphering rectangle are transcnbed m formmg the mphe1 text Commonly thIS numencal 
key is denved from a hteral key 
Suppose that a cryptographic clerk makes a IDIStake m the 
latter step 
For example, suppose that the hteral key is ADMIRATION and that as a result of a 


shght relaxation m attention he assigns the number 5 to the lette1 N and the number 6 to the 
letter M 
A pair of columns will become mterchanged as regards then order of selection ID the 
transcnption process, and hkely as not a repet1t1on will be ieque'lted by the addressee If a 
second version IS sent, enciphered by the correct key, a comparison of the two versions will dIS- 
close the width of the enciphering rectangle and pos.,1bly the general position (left or nght) of 
the columns that were mterchanged 
b An example will serve to make the matter clear Assume the two cryptograms to be as 
follows 


0 D N I L 
I N E N E 
0 0 c 0 0 


0 D N I L 
U EHR W 
0 0 c 0 0 


NT TH D 
NF U EH 
R 0 G I 0 


NT TH D 
R P S I N 
R 0 G I 0 


FIRST VERSION 


G S 0 H A 
R WR RI 
s 


SECOND VERSION 


G S 0 H A 
E N E R I 
s 


O O Q S G 
R A T P E 


0 0 Q S G 
R A T P E 


T E R P S 
DE TAN 


T E R N F 
DE TAN 


c The two cryptograms are superimposed as shown m figure 24 and their pomts of simtlanty 


and difference noted 


First version___ 0 D N I L N T T H D G S 0 H A 0 0 Q S G T E R [ P S I N E N E] 
Second version_ 0 D N I L N T T H D G S 0 H A 0 0 Q S G T E R [ N F U E H R W 


[N F U E H R W R]R I R A T P E D E T A N 0 0 C 0 0 R 0 G I 0 S 
R]P S I N E N E]R I R A T P E D E T A N 0 0 C 0 0 R 0 G I 0 S 
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d The two versions aie ahke except for a pair of mterchanged sequences, the bracketed 
sequence P S I N E N E m the first version IS matched by the same sequence m the second 
ve1sion, but at a different position ID the message, likeWISe the bracketed sequence 
N F U E H R W Rm the first version is matched by a simtlai sequence m the second version, 
but at a different position m the message 
The vanous deductions which can be made from the 
s1tuat1on will now be set forth 
e One of these sequences contams 7 letters, the other contams 8 It follows that the col- 
umns of the enmphermg rectangle are probably 7 and 8 letters m length, hence, with 61 letters, 
the width of the matnx IS 8 
Smee there are 23 letters from the begmnmg of the messages to the 
first pomt of their difference, it follows that there are 2 columns of 8 letters and 1 column of 7 
letters mvolved m thIS section [(2X8)+ (1 X7)=23], and that the error made m enmpherment 
does not rnvolve columns 1, 2, or 3, which are therefore properly placed m the first version Smee 
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the sequences which are mterchanged are consecutive m the text it m<'ans that the numbers 4 
and 5 were mterchanged m the key for the first version 
Smee one of these sequences IS of 7 
letters, the other of 8 letters, one of the numbers, 4 or 5, applies to a long column, the other, to 
a short column 
Smee the second version IS presumably the correct vers10n, and smce m the 
second version the 8-letter sequence comes first, the key number 4 applies to a long column, the 
key number 5 to a short column m the correct version 
With the foregomg deductions m mmd, 
the solution and the reconstruct10n of the numencal key becomes a srmple matter 
f The text of the correct version is wntten out as seen m figure 25a 
SeeIDg a Q ID column 3 


and a Um column 4, these two columns are made adJacent by shdmg column 3 one mterval down- 
ward, as shown m figure 256 
In the latter, column 7 has also been placed at the second mterval 
to the right of column 5, because the latter yields good tngraphs with columns 3-4 
SeeIDg the 


tngraph T R 0 near the bottom of columns 3-4-5 and the letters 0 and P ID the same row, sug- 
gests the word TROOP 
The columns are to he reairanged to make this word TROOP 
There are 


1 
2 
~ 
4 
'i 
6 
7 
8 
a 
c 
t 0 
d 0 
0 H 0 N P R E 0 
D D Q F S I T R 
N G S U I R A 0 
I S G E N A N G 
L 0 T H E T 0 I 
N H E R N P 0 0 
T A R W E E C S 
T 0 
R 
D 0 


a 


12141678 


c 
a 
d 
o 


0 T 0 N E R P 0 
D H 0 F T I S R 
N D Q U A R I 0 
I G S E N A N G 
L S G H 0 T E I 
N 0 T R 0 P N 0 
T H E W C E E S 


ARR 0 D 
b 
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3 
4 
5 
2 
6 


0 NET R 
0 F T H I 
QUAD R 
SENG A 
G H 0 S T 
T R 0 0 P 
E WC HE 
R R 0 
D 


c 


34726815 
0 N E T R 0 0 P 
0 F T H I R D S 
Q U A D R 0 N I 
SENGAGIN 
G H 0 S T I L E 
T R 0 0 P 0 N N 
EWCHESTE 
RR 0 AD 


d 


two columns whu.h have an 0 m tlH' prnper row, columns 2 and 8 
The trial of combIDation 


3-4-5-8--6, whtle producIDg TROOP ill the proper rnw, gives bad pentagraphs m the other rows, 
but the combIDation 3-4-5-2-6 shows excellent pentagraphs, as will be seen m figure 25c 
The 
words SQUADRON and HOSTILE are clearly evident, the complet10n of the rectangle IS now a. 
very srmple matter 
The result is shown ill figure 25d 
The recovery of the numerical key now 


wtll enable other cryptograms to be read directly 
23 llessa.ges with sumla.r beginmngs -a In nnhtary correspondence it is often the case 


that somewhat srmtlar mstruct1ons or mformat10n must be conveyed by a superior commander 
to several subordIDate commanders srmultaneously 
Such a s1tuat10n frequently results ID the 
circumstance that two or more cryptograms addressed to different stations will begm with exactly 
the same words 
When snnple columnar transposition IS the system used for enc1pherment, 
then it will result, m such cases as the foregomg, that the first two or more rows of the transposi- 
tion rectangle will be identical ID the messages which begin alike 
Therefore, the cryptograms 


will show identical sequences of two or more letters, distributed throughout the texts and by 
studymg these identities the cryptanalyst is able at once not only to ascertam the width of the 
rectangle but also to d1v1de up the cipher text mto sections correspondmg with the exact columns 
of the rectangle, thus ehmIDatmg the only real dJ.fficulty m solut10n, mz, the determmat1on of 
which are the long columns, which the short 
An example wtll demonstrate the short cut to 


solution which such a s1tuat1on provides 


b Here are two cryptograms which are assumed to have been mtercepted withm a few nnn- 


utes of each other, the messages beIDg addressed to two battahon commanders by the regimental 
commander 
L 
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CRYPTOGRAM 1 


B N T S E A R K C L C E T T N B I T E R R 0 T A E L T N N 0 N NE N 0 
0 T 0 K M S Z T G N YI TDK LAN A E F T F S N P G N P A R W 0 I A 
0 F G T F C T 0 T D NIN 0 E W XE RF A S I 0 S TI DR R RMMAO 
ARP AT 0 U T I 0 B I E 0 A GA AP N E I K 


CRYPTOGRAM 2 


B N T S E I N D 0 T L C E T S AF PL E RR 0 M 0 I S 0 E N N 0 NS T 
I I U T 0 KM FEY K P C Y I 
T D V S I NT A E F T F S T 0 NTNAR 
W 0 A R 0 EEKTF C T T L T A EA N 0 E W X P V T I T I 0 S T T T F 
0 CM MA 0 0 S C A N R 0 UT I E E L S 0 AG A A AB I TR T 
c The cryptanalyst, notmg the similarities m the first few letters of the two messages, care- 
fully compares the two texts, lookmg for add1t10nal 1dent1cal sequences of letters between the 
cryptograms 
For example, No 1 begms with B NT SE and so docs No 2, after an mterval 
of 4 letters ID No 1 and 5 letters m No 2 he not<>s the 1den tical sequences L C E T, after an 
mterval of 5 letters ID No 1 and 5 letters ID No 2 he notes the 1dent1cal sequences E R R O, 
and so on 
The identities are undcrlmed or marked m some distmctive manner throughout the 
texts, as shown ID figure 26 


CRYPTOGRAM 1 


B NT SE ARK CL C E T T N B I T E R R 0 T A E L T N N 0 N NE N 0 


0 T 0 K M S Z T G N YI TDK LAN A E F T F S N P G N P A R W 0 I A 


0 F G T F 
C T 0 T D N I N 0 E W XE RF A S I 0 S T I D R R RM MA 0 


ARP AT 0 U T I 0 B I E 0 A GA AP N E I K 


CRYPTOGRAM 2 


B NT S E 
I N D 0 T L C E T S AF PL E RR 0 M 0 I S 0 E N N 0 N S T 


I I U T 0 
KM FEY K P C Y I T D V S I 
N T A E F T F S T 0 NTNAR 


W 0 A R 0 EEK T F C T T L T A E A N 0 E W X P V T I T I 0 ST TT F 


0 C M M A 0 0 S C A N R 0 U T I E E L S 0 A G A A AB IT R T 
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d Now it is obvious that these identities exist because the two messages begm alike, and 


by takmg advantage of the 1dent1cal portions m the cryptograms it will be posB1ble to transcribe 
the texts of the latter mto transposition rectangles wlnch will not only have the identical por- 
tions m homologous positions, but also wtll show wlnch are long columns, which are sho1 t 
All that IS necessary is to begill transcnbIDg the texts on cross-section paper, ill columns, e.rrangmg 
matters so that the identical sequences will fall at the tops of the columns 
Thus, the first 
column of No 1 will con tam the letters B N T S E A R K C and the first column of No 2 wtll 
conte.m the letters B N T S E I N D 0 T, the second column of No 1 will contam the letters 


~....£..! T N B I T and the second column of No 2 wtll con tam the letters L C E T S A F P L, 


324155-41-4 


a.n.d so on 
It appears that the identical portion embraces the first four rows of the rectangle a.n.d 


runs over a. number of letters on the fifth row 
This is because the identical sequences consISt 
of 4 and 5 letters 
Figure 27a shows the identities between the first 5 columns of the two trans- 
position rectangles 
Only once m the case of this particular example does any uncertamty anse 
as to exactly where an identical sequence begms or ends, and that is m connection with the 
seventh pair of identities, mvolvmg the senes of letters A E F T F S N P G N Pm No 1, a.n.d 
A E F T F S T O N T Nm No 2 
These sequences contam 6 identical letters, but even here 
the uncertamty is of only a moment's duration The mitial letter A does not belong to the iden- 
twal portions at the top of the transposition rectangle because the A's arc needed to complete 
columns 6 m both rectangles 
(If the A were placed at the head of column 7 in No 1, then 
column 6 would lack a letter at the bottom ) 
Cases of "accidental identities" of course com- 


plicate the process of cutting up the text into the respective columns, but they only serve to 
add a small degree of interest to what would otherwise be a purely cut and dried process 
The final results of the transcription mto columns are shown in figure 27b 


1 
B L E N T 
N C R N 0 
T E R 0 K 
S T 0 N M 
ET TN s 
AN A E Z 
RB ENT 
K I L 0 G 
CT T 0 N 


2 
B L E N T 
N C R N 0 
T E R 0 K 
S T 0 N M 
Es Ms F 
I A 0 T E 
N F I I Y 
D P S I K 
0 L 0 U P 
T 
E 
C 
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e It is obvious from a. comparison of these two skeletomzed matnces, a.n.d a consideration 
of the fact that the long columns must of nec,essity go to the left side, that the numbers 7 and 10 
occupy the first two positions in the key, and that the numbers 2, 4, 11, and 13 occupy the last 
four positions m the key 
By segregatmg and anagramming columns 7 and 10 as one group, 


l 


1 
2 
& 
4 
5 
6 
7 
8 
91011121314 


B L E N T Y E A T N I M 0 A 
N C R N 0 I F R F 0 0 M U G 
T E R 0 K T T W C E S A T A 
S T 0 N M D F 0 T W T 0 I A 
E T T N S K § I O ! I A O P 
ANAEZLNATEDRBN 
R B E N T A P 0 D R R P I E 
K I L 0 G N G F N F R A E I 
C T T 0 N A N G I A R T 0 K 
p 
s 


2 


1 
J 
3 
4 
5 
6 
7 
8 
q 
10 11 
~ n 14 
B L E N T Y E A T N I M 0 A 
N C R N 0 I F R F 0 0 M U G 
T E R 0 K T T W C E S A T A 
S T 0 N M D F 0 T W T 0 I A 
ESMSFV§AT!TOEA 
I A 0 T E S T R L P T S E B 
N F I I Y I 0 0 T V F C L I 
D P S I K N N E A T 0 A S T 
0 L 0 U P T T E E I C N 0 R 
T 
E 
C A N K A T 
R 
T 
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a.n.d columns 2, 4, 11, and 13 as another group, the exact positions occupied by these 6 columns 
a.re eastly ascertained, as shown m figurl' 27 c 
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1 
2 
7 
10 
2 
11 13 
4 
7 
10 
2 
11 13 
4 


EN 
L I 0 N 
EN 
LI 0 N 
F 0 
C 0 UN 
F 0 
C 0 UN 


T E 
E S T 0 
T E 
E S T 0 


F W 
T T I N 
F W 
T T I N 
s x 
T I 0 N 
s x 
STE S 


NE 
ND BE 
T p 
ATE T 
p R 
B R I N 
0 v 
F F L I 
G F • 
I R E 0 
NT 
P 0 S I 
NA 
T R 0 0 
T I 
L C 0 U 


p s 
NT 
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f The remammg columns 1, 3, 5, 6, 8, 9, 10, 12, and 14 form a third group of columns to be 
anagram.med, but this is rather easy now that the columns on either Side are fixed 
The com- 
pleted rectangles are shown m figure 27 d 


1 
7 10 
3 
~ 6 11 
4 u 5 
8 
2 
11 
~ 4 


E N E M Y B A T T A L I 0 N 
F 0 R M I N G F 0 R C 0 U N 
T E R A T T A C K W E S T 0 
F W 0 0 D S A T M 0 T T I N 
S X T A K E P 0 S I T I 0 N 
NEARLANTZANDBE 
P R E P A R E D T 0 B R I N 
G F L A N K I N G F I R E 0 
N A T T A C K I N G T R 0 0 
p s 


2 


710312 6114 u 
5 
8 
211134 
E N E M Y B A T T A L I 0 N 
F 0 R M I N G F 0 R C 0 U N 
T E R A T T A C K W E S T 0 
F W 0 0 D S A T M 0 T T I N 
SXMOVEATFASTES 
T P 0 S S I B L E R A T E T 
0 V I C I N I T Y 0 F F L I 
N T S A N D T A K E P 0 S I 
T I 0 N T 0 R E P E L C 0 U 
NTERATTACK 


FIOUBB 27d 


24 Messages with sumlar endings -a What has been said at the begmmng at the pre- 
cedmg paragraph with respect to the nature of military correspondence and the presence of 
identical phraseology m the messages sent by a. supenor commander to h1S subordmates also 
operates to produce messages m which the endmgs are identical 
It has been noted that when 
two messages with similar begmnmgs are available for compauson, the reconstruction of the 
transposition rectangles aud the recovery of the transposition key is an easy matter 
It will 


now be shown that solution is an even easier matter when two messages havmg identical endmgs 
a.re available for study 
b Given the following two cryptograms 


No 1 
ETRTE EESOA AEUNI VAFLN IAMND RYHRV MENRI 
EETRO UDCCC OHTCY MRREA RHITN DEYEN RNERV 
SRBEN IGSKA ILNRA NFNAD ALOLT XOMAH HRREI 


No 2 


TLVSX OPNRE MEFDS KYENR UEERB TSREH TIANT 
IVYMR VESIR EENEI NOLTM NNEDE TROOP UNARA 
CIAAI NSCWN A 
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The cryptanalyst now carefully compares the two texts, searchmg for identical sequences of 
letters, but m t1us case mstee.d of trymg to locate identities m what may be termed e. parallel 
progression (as m the precedmg case) he searches for identwal sequences of two or more letters 
appeanng m both messages 
For example, m the present case, he notes the sequence T R 0 
formmg the final trigraph of the 8th group of No 1 and finds a similar sequence formmg the 
mitial tngraph of the 13th group of No 2 Gomg through both cryptograms m this way, all the 
identities are marked off m some fashion, by colored ere.yon or underlmmg, as shown below 
In 


this search for identities the cryptanalyst bears m mmd that when all have been found they 
should be distnbuted at qmte regular mtervals throughout the text 
For example, note m the 
followmg that the identities m No 1 fall at mtervals of 6 letters, with one exception, m No 2 
they fall at mtervals of 4 letters, with one exception The mtervals between identities serve as a 
gmde m findmg them 
After they have all been located, the identities m the cryptograms a.re 


numbered senally 


No 1 


ET RTE EE S 0 A A E U N I 
VA FL N I A M N D RTHRV MEN RI 
-r 
-r- 
""'3 
.,.... 


E E T R 0 
U D C C C 0 HTC Y MRREA R H I T N DEY EN RN ERV 
--r- 
--& 
-;- 
~ 
SR BEN I G S K A IL NRA NF NA D A L 0 L T X 0 MAH HR RE I 
,.... 
---w- 
""il 
12 
la"'" 


No 2 


TLVSX OPNRE MEFDS KYENR UEERB TSREH TIANT 
-r- 
-r 
---a- 
,..... 
..,- 
IVY MR VESIR EENEI NOLTM NNEDE TROOP UNA RA 
.,... 
-r- 
c I A A I 
N S C W N A 


c The identities between the two cryptograms may now be equated, usmg for t1us purpose 
the numbers below the identities 
For mste.nce, identity 1 m cryptogram 1 matches identity 7 
m cryptogram 2, identity 2 m crytogram 1 matches identity 6 m cryptogram 2, and so on Thus 


Cryptogram !__________________ 1 2 3 4 
5 6 
7 8 9 10 
11 
12 
13 
Cryptogram 2 __________________ 7 6 9 2 10 5 11 
3 4 12 
13 
1 
8 


d Now cryptogram 1has105 letters, smce the key consists of 13 numbers (mdwated by the 
13 identities), the rectangle for cryptogram 1 contams 12 columns of 8 letters and 1 column of 9 
letters 
Cryptogram 2 has 81 letters, and its rectangle contams 10 columns of 6 letters and 3 
columns of 7 letters 
The rectangle of cryptogram 1 has but 1 long column, whereas that of 
cryptogram 2 has 3 long columns Relative to the position the last letter m each rectangle occu- 
pies m the last row of the rectangle, it is obvious that the last letter of the rectangle for crypto- 
gram 2 is 2 letters m advance of the last letter of the rectangle for cryptogram 1 
Usmg this 


difference, viz, 2, a cychc sequence is generated from the series of eqwvalencies given above 
Thus, the eqmvalent of identity 1 of cryptogram 1 is identity 7 of cryptogram 2, and the number 
7 is placed two mtervals to the right of the number 1, the eqmvalent of identity 7 of cryptogram 
1 is identity 11 of cryptogram 2, and the number 11 is placed two mtervals to the nght of number 
7, and so on until the followmg sequence is obte.med 


1 2 3 4 5 6 7 8 9 10 
11 
12 
13 
1 
7 
11 
13 
8 
3 
9 
L 


e The eqmvalent of identity 9 of cryptogram 1 is identity 4 of cryptogram 2, e.nd the num- 
ber 4 is placed between the numbers 1 and 7 m this sequence, for the sequence may be regarded 
as partakmg of the nature of a cycle or a contmuous senes From this pomt on, the process is 
the so.me as before, and finally the followmg is obte.med 


1 2 3 4 
5 6 
7 8 9 10 
11 
12 
13 
1 4 7 2 
11 
6 13 
5 8 10 
3 12 
9 
f After little experrment it becomes obvious that column 8 belongs on the extreme left 
because m cryptogram 1 there is only one long column, number 81 ascmtamed by countmg the 
number of letters between successive identities m that message 
The number 8 bemg at the 
extreme left the final actual transposition key is 8 10 3 12 9 1 4 7 2 11 6 13 5 
The completely 


deciphered messages are shown m figure 28 


No 1 


8 
10 
3 
12 
9 
l 
4 
7 
2 
l1 6 
13 
6 
HEADREDCOLUMN 
INFANTRYANDAR 
T I L L E R Y M A R C H I 
NGNORTHREACHE 
DSILVERRUNCRE 
EKATSEVENFORT 
YAMXREMAINHER 
E I N 0 B S E R V A T I 0 
N 


No 2 


8103129 1 "7 211613 
I N F A N T R Y P 0 I N T 
REDCOLUMNPASS 
EDSILVERRUNCR 
EEKATSEVENTWE 
NTYAMXREMAINH 
E R E I N 0 B S E R V A T 
I 0 N 


FIGURE 28 


g The possibility of the rapid solution of columnar tiansposition ciphers by means of the 
method of slIDllar begmnmgs and endmgs, constitutes one of the most serious drawbacks to the 
use of transposition ciphers m military cryptography, because it is almost rmpossible to av01d 
such cases where many messages must be sent m the same key each day 


26 Solution of & single message cont&imng & long repetition -a Sometimes a lengthy phrase 
or a series of numbers (spelled out m letters) is repeated within a message and if the message 10 
enciphered by a transposition rectangle of such narrow width (m comparison with the length of 
the repetition) that the repeated portion forms identical sequences within the text of the crypto- 
gram, a solution somewhat srmilar m prmciple to that explamed m paragraph 24 may be achieved 
withm a few mmutes 
b Note the followmg cryptogram, m whi<,h identical port10ns have been underlmed 


CRYPTOGRAM (169 letters) 


0 EA EL T R S E D 
H NU FF RN RY F NT A ED I L u_x 
la 
-lb- 
2a 


N C E T S 
L S T 0 C A W I A 0 
T S L S S LED H N 
0 R I I S 


2b 
3a 
3b 
FEB N N UUPWE SS MY E RC N N 0 
RV TT A 
0 GNU Q 
-,a- 
-,b- 
6a 


G T I F E RS E 0 M SW ER N RAST B 
0 SA A A 
O S N O 0 
_5_b_ 
6a 
6b 


I B 0 S D CAY H L 
H 0 NE M SET FY HLAUX TA 0 G G 
-711- 
-7b- 
114 
-Sb- 
PR S V L 
YEE G G T I S S 0 u up v 


9a 
-911- 


I 


I I 


c There are IS segments of underlmed letters, which means m this case that the rectangle is 


9 columns wide, because the repeated port10n m the text will give nse to two repeated sequenoes 
m each column 
ThIB means that the rectangle has 7 columns of 19 letters and 2 columns of IS 


letters 
The first two segments may therefore be assigned the numbers la and lb, smce they 
come from column 1, the next two segments may be assigned the numbers 2a and 2b, smce they 
come from column 2, and so on, as shown above 
Identical segments may now be equated 
Thus 


Ia 2a 3a 4a 5a 6a 7a Sa 
9a 
3b 
4b 
2b 
9b 
Sb 
Ib 
6b 
7b 
5b 


Tills gives nse to the cycle 1-3-2-4-9-5-S-7-6, which is a cyclic permutation of the actual 
transposition key 


d By transcr1bmg the text mto a rectangle of proper width, "cuttmg" the columns so as to 
brmg the identical portions w1thm the same rows, the result shown m figure 29 is obtaIDed 
1234667 8 
9 
4 
6 
9 
6 
3 
8 
2 
7 


0 
E 
A 
E 
L 
T 
R 


F 
N 
T 
A 
E 
D 
I 


T 
0 c 
A w 
I 
A 


R R E 
I 
C R 
I N S 
S 
N E 
F 
0 
0 


E R M 
B 
V 
S 


A 
0 
P 


A N R 
0 E S 
S 
M 
V 


N S L 
0 E Y 
0 
T 
E 


[ 
:[~[~ :[~ ~[~[~[~ 
~ ~ ~ [~ ~ [: ~ ~ ; 
N N S P G R D A I 
U C S W N A C U S 


[~ [~ [~ [! [i [![~ [~ [~ 
R S N Y I 
S H G P 
Y 
0 E F A 
G V 


FIGUBJ: 29 


R E P 0 R T 0 F A 
I 
R R E C 0 N N A 
I 
S S A N C E T 0 
S E V E N A M A S 
F 0 L L 0 W S E N 
E M Y T R I 
E D 0 


B S E R V A T I 
0 


N W E S T 0 F L I 
N E G E T T Y S B 
U R G D A S H M 0 
U N T H 0 L L Y S 
P R I 
N G S A N D 
W A S U N S U C C 
E S S F U L X E A 
S T 0 F G E T T Y 
S B U R G D A S H 
M 0 U N T H 0 L L 
Y S P R I 
N G S H 
E A V Y F 0 G 


FIGUBB 30 


e Study of figure 29 showi. that columns 2 and 7 are the short c,olumns and belong on the 


nght, either m the sequence 2-7 or 7-2 
The cychc permutation of the transposition key obtamed 
m subparagraph c is 1-3-2-4-9-5-8-7-6 
In order to brmg the 2 and 7 adjacent ma sequence 
2-7 or 7-2 one must take mtervals of 5 and 4, respectively, and "decimate" the cycle, gxvmg the 
followmg 
1-5-3-S-2-7-4--6-9 or 1-9-6-4-7-2-S-3-5 
Smee columns 2 and 7 belong on 


the right, the key must be 4-6-9-1-5-3-S-2-7 or 8-3-5-1-9--6-4-7-2 Only a few moments are 
necessary to establish the correctness of the former alternative and the solution is at hand 
It lS 


as shown m figure 30 


f A good understandmg of the prmmples elucidated m this and the piecedmg paragraph 


will enable the student to denve for filmself the procedure applicable to cases of somewhat 
slDlilar nature, such as that wherem a smgle letter or a whole group has been omxtted from the 
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first version of a message and a second (correc..tion message) is sent without paraphrasIDg the 
ongmal text, or that whereID two messages are alike except for a drlferenoe ID a smgle word (such 
as a number) and are cryptographed by identical transposition keys, or that wherein the numen- 
cal key has been mcorrectly denved f1om ~heh teral key and two versions of the same plam text are 
available for comparison, one based on a transposition by means of the mcorrect key, the second 
based on a transpos1t1on by means of the correct key, both keys, however, bemg of the same 
length 


26 Solution when several cryptograms of identical length and in the same key are avail- 


able -a Although the method to be descnbed m this paragraph is mcluded w1thm the category 
of spemal solutions, it is of such general applicability that it might well be treated as a general 
solution for all transpos1t1on systems 
It is based upon the very mechames of transpos1t1on as a 


cryptographw scheme, viz, that the essential feature of the tran1>pos1tion method consISts merely 
m the alterat10ns m the positions of the elements (letters, groups of letters, or words) composmg 
the plam text, accordmg to a spemfic key It follows, therefore, that the respective elements of 
two or more messages of identical lengths, when transposed accordmg to the same key, will undergo 
identical alterat10ns m posit10n m the course of enmpherment, and therefore all plaID-text ele- 
ments occupymg homologous pos1t1ons m the or1gIDal messages will emerge m homologous posi- 
tions ID the cryptograms 
The situation is very much hke that which may be observed m the 
movements executed by two symmetrical groups of dancers m a chorus 
Suppose each group 


consists of S dancers startmg origIDally ID defimte positions relative to one another 
When a 


movement is executed each dancer m each group performs certam evolutions, at the conclusion 
of the movement the S dancers m each group may be m quite different positions relative to one 
another than they were at the begmmng of the movement, but the correspondmgly numbered 
dancers m both groups find themselves m identical positions relative to their neighbors 
Of 


course, the fact that m this analogy the groups are based upon S's IS of no s1gmficance, if the 
groups conslSted of many more the pnnc1ple wou]d still apply 
Another way of lookmg at the 
matter is to call attention to the fact that in any type of transposition the position which a specified 
letter or element of the plain text will ocC'Upy in the final cryptogram is quite defin'llely a f'unc1ion of the 
number of letters or elements in the plain text 'llself 
For example, suppose that a ple.m-text message 
contaIDs exactly 100 letters, and suppose that the transpos1t1on system and specific key is ouch 
that the 1st plam-text letter appears as the 17th cipher-text letter, the 2d plaID-text letter, as the 
6Sth, and so on, m another message of exactly 100 letters, enciphered by the same general system 
and specific key, it is obv10us that the 1st plam-text letter must also appear as the 17th c1pher- 
text letter, the 2d plam-text letter, as the 6Sth, and so on 
In short, all correspondmgly num- 


bered plam-text letters m both messages will appear m identical positions m the cryptograms 
b Grantmg the obvious truth of the foregomg, to what use can it be put m the solut10n of 
transpos1t1on ciphers? Srmply this It enables the cryptanalyst to reconstruct the plain texts of 
cryptograms of identical length without even knowing what the transposition key or system was that 
produced them 
The process is not at all comphcated and if there are several messages the 
process is very easy 
It consists m supenmposmg the several cryptograms and anagramming 
the columns formed by the supenmpos1t1on, for it is obvious that any circumstances which can 
be used as a gmde for rearrangmg the letters m one of the Imes of supenmposed text m order 
to form plam text will reqmre, and can be checked by, the results of an identical rearrangement 
of the correspondmg letters of the other Imes of superimposed text 
c An example of the method mvolvmg the application of this geneial solution will now 
be given, usmg as a basis five messages assumed to have been enciphered by an unknown but 
complex type of transposition It will now be shown how the security of such a system is demol- 
ished when it is used by a large number of mtercommunicatmg commands 
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d Let the followmg be five cryptograms isolated from among many messages mtercepted 
on the same day and therefore suspected of bemg m the same key 
These five cryptograms 
have been ISOiated because they all contam exac,tly the same number of letters 
They are here 
shown superimposed (fig 31) and therefore all the letters m one column have undergone exactly 
the same evolutions or changes m pos1t1on m the course of enmpherment 


Column No__ _ _ 1 
2 
3 
4 
5 
6 
7 
8 
'I 10 11 12 13 14 15 16 17 18 19 20 21 22 21 24 25 2fl 27 28 29 30 31 32 


MessaseN01 
I A AL NE 0 F SGT 0 G VER AN 0 L ND U 0 DE IHI SAT 


Me11811geN02 
.TD NM R GR E 0 NARI EU ET NY ITC 0 FE A IE UTT A 


MeesageNo3. 
AN EL NE XE HG IL ACE MEE NL F X TEE EIS I GA 0 


Message No 4 
E E N E T S L N N F T C 0 I D 0 S E A I L F I G D W I A A R N 0 


MessageNo5 
.RAM ET MI 0 N 0 DI UM ALL IN X 0 AT GT N NA I BT N 


Column No ___ - 33 34 is 36 37 38 19 40 41 42 43 44 45 46 47 48 4'1 00 51 


MessageNo 1 


Meesage No 2 _ 


MessageNo 3 


MessageNo 4 


MessageNo 5 


F T D N R L V 0 R 0 D S W E E R 0 R Q 
RDTEDNSOEIPECMFEARN 
.RWLLDLVVORDELOCHOTH 
.IHNLLNRFVWLREMRAIEA 
.HITNIASDRMSECUIOVSA 
FmuRJi: 31 
e Notmg a Q m message 1 wlumn 51, the obligatory sequence Q U 1s ltbsume<l to be present 


lll that message 
There 1s m message 1 but one U, which is fortunate 
Combmmg columns 51 
and 23, the results are found to be farr (fig 32a) 
The H T m the thll"d iow suggests a word 


endmg m G HT, such as FIGHT, MIGHT, EIGHT, etc, 
Searchmg m message 3 for a G, two candi- 


dates are found columns 10 and 30 
The trigraphs yielded by each combmation are shown m 


figure 32b 
The second of the two poss1b1hbes Jooks muc,h the better 
The trigraph m the 


ll..!!. 
10 51 23 
:!2...!l...!! 
'lO 51 23 11 
'lO 51 23 31 22 
Q u 
G Q U 
s Q u 
SQ U A 
SQUAD 


N 0 
N N 0 
T N 0 
T N 0 T 
T N 0 T C 
HT 
G HT 
G HT 
G HT A 
GHTAX 


A I 
F A I 
R A I 
RAIN 
RAIN F 
AT 
0 A T 
B A T 
B A T T 
BATT A 


FIGUBB 32a 
Ft!'UllE 32b 
FI!'UllE 331 
FIC'UllE 33b 


first row suggests the word SQUARE or SQUADRON, that m the last row suggests BATTLE or 
ATTALION 
This means that a column with an A at the top and a Tat the bottom should be 
sought 
There 18 only one such column, 31 
Addmg it to the 30-51-23 combmation gives 


what 18 shown m figure 33a 
Lookmg for a column with a D at the top (for SQUAD) and either an 
A (for BATTALION) or an L (for BATTLE), there is only one candidate, column 22, y1eldmg the 
sequences shown m figure 33b 
Enough has been shown of the procedure to make further demon- 


stration unnecessary 
Once a good start has been made, progress is qmte rapid, unless the 
cryptanalyst is unfortunate and arrives at a pomt where all the messages srmultaneously ter- 
m.mate m complete words, without a clue as to what follows or precedes m any one of the mes- 
sages 
In such a contmgency the only thmg he can do is to try all sorts of possible contmuat1ons, 


either "fore" or "aft," that is, m front of the ongmal startmg pomt or after it, until he picks up 
another word which will enable hrm to contmue 
Or he may have to search for a new pomt of 
entry and build upon that, later ]ommg this structure with the other 
In the case under ex- 


ammation no senous difficulties are found and the entire set of five messages is reconstructed 
J In the course of this reconstruction the numbers apphcablc to the columns become assem- 
bled m proper sequence, that is, m the correct oider to reproduce the plam text. Tb.is sequence, 


j_~ 
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constitutmg the c~P sequence, is shown m figure 34 as the second row of numbers 


Tenn number 
__ 
_ 
1 2 
3 
4 
5 
6 
7 
8 
'I 10 11 
12 13 14 15 16 17 18 19 20 21 22 23 24 
2~ 26 27 28 29 30 


C-+P sequence __ ___ 
28 
8 
14 46 19 37 25 47 48 26 35 4J 
2 34 27 12 36 45 17 13 40 18 
9 
24 13 
8 
1 
00 44 11 


Message No 1 
__ 
__ H A V E 0 R D E R E D R A T I 0 N W A G 0 N S 0 F F I R S T 


Message No a____ 
__ 
E N E M Y D E F E A T E D D I R E C T I 0 N 0 F R E T R E A 


Message No 3_ 
_ _ S E C 0 N D E C H E L 0 N W I L L L E A V E H E R E A T E I 


Message No 4 _ _ _ _ A N I M A L D R A W N V E H I C L E S 0 F E N G I N E E R T 


Message No s ___ ------ A M M U N I T I 0 N T R A I N I N C L U D I N G H 0 R S E D 


Term number. ___ _ 
31 32 33 34 35 86 37 38 
39 40 41 42 43 44 
4~ 46 47 48 49 
511 
51 


C-+ p sequence ___ ____ 30 51 23 31 22 16 
7 
21 32 42 10 49 
4 43 15 
5 
39 29 20 38 
6 


Ml'S~age No 1 
__ S Q U A D R 0 N T 0 G 0 L D E N V I L L E 


Message No 2 ____ __ _ T N 0 T C E R T A I N A M P U R S U I N G 


Message No a___ __ --- G H T A X M X F 0 R G 0 L D E N V I L L E 


Ml'S&age No 4 _ _ __ R A I N F 0 L L 0 W F I E L D T R A I N S 


Message No s __ _ _ B A T T A L I 0 N M 0 V E S A T S I X A M 


FIGUllE 34 


g The solution by super1mposmg and anagrammmg equal-length messages m the case of 


tianspos1t1on c,onst1tutcs a general solutwn which is applicable ill all cases without e'Cc,eption 
Indeed, the possibility of solution by th\S method constitutes the most serious, if not fatal, weak- 
ness of tre.nsposit10n as a cryptographic method, for not only is it applicable to the most complex 
as well as to the most simple types of transposition, but, what is much more senous, the pro- 
cedure is very simple, requmng very httle cryptanalytic mgenmty or expertness 
The chief 


disadvantage of this general solution is, of course, that it is dependent upon the more or less 
fortmtous availability of messages of identical lengths, and while this fortunate contmgency is 
qmte frequent m a volummous correspondence, 1t would naturally be better from the pomt of 
view of the cryptanalyst 1f this reqmrement were not essential m all cases 
Deeper study of 
the subJect will show that the method ce.n still be apphed ill a modrli.ed way to the case of mes- 
sages of almost the same lengths when the transpoSit1on is not too mvolved 
To illustrate, 


a case of srmple keyed-columnar transposition will be used and it will be assumed that several 
messages of approxrmately 1dent1cal lengths are at hand 
h Frrst, take the case of two messages which have been enciphered by completely-filled 
rectangles, one messvge havmg, for example, one more row of letters than the other 
In the 
d1scuss1on, the consecutive numbers 1, 2, 3, 
will be employed as though they constituted 


the successive letters of a plam-text message that is bemg enciphered 
This method of treat- 
ment is very useful m connection with studies of the mechamcs of transpos1t1on ciphers m 
general, and especially so m the case of double transposition 
Note the P~c sequences that 
result from the transposition 


6257413 
01 02 03 04 05 06 07 
08 09 10 11 12 13 14 
15 16 17 18 19 20 21 
22 23 24 25 26 27 28 


A 


6257413 
01 02 03 04 05 06 07 
08 09 10 11 12 13 14 
15 16 17 18 19 20 21 
B 


P-+C sequence for A ____ 06 13 20 27 02 09 16 23 07 14 21 28 05 12 19 26 03 10 17 24 01 
08 15 22 04 11 18 25 


f-+C sequence for B_ ___ 06 13 20 02 09 16 07 14 21 05 12 19 03 10 17 01 08 15 04 11 18 


;FIGUllll: 3&J 
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It is obvious that the two sequences may be superimposed so as to brmg identical sections mto 
superrmposition 
Thus 


A. _____ 06 13 20 27 02 09 16 23 07 14 21 28 05 12 19 26 03 10 17 24 01 08 15 22 04 11 18 25 
B _____ 06 13 20 D 02 09 16 D 07 14 21 D 05 12 19 D 03 10 17 D 01 08 15 D 04 11 18 O 


The I blank spaces m the B lme mark the ends of the columns m the transpos1t1on rectangle 
The regularity m the d1stnbution of the blank spaces follows from the mechanics of encipherment 
If two messages were superrmposed m thlS manner it is clear that a solution by anagrammmg 
becomes perfectly feasible 
Moreover, anagrammmg of columns is perhaps unneressary, for 
anagrammmg merely the letters that would occupy m lme A. the positions marked by the blanks 
m lme B will yield the transposition key duectly 
Extens10n of these prmciples to the case m 


which the two rectangles dllfer by 2, 3, 4, 
complete rows is obvious 


i Takmg next a case wherem two rectangles dllfer by one or two letters m the bottom row, 


it is clear that by shiftmg the letters of one message one or two spaces to the right (or left) from 
a given pomt will brmg most of the text mto proper superimposition for a solution by anagram- 
mmg 
Note the P-+C sequences applicable to the followmg transpositions 


6 2 5 7 4 
1 3 


01 02 03 04 05 06 07 
08 09 10 11 12 13 14 
15 16 17 18 19 20 21 
22 23 24 25 26 27 


A. 


6 2 5 7 4 1 3 
01 02 03 04 05 06 07 
08 09 10 11 12 13 14 
15 16 17 18 19 20 21 
22 23 24 25 
B 


P-+0 sequence for .A. ___ 06 13 20 27 02 09 16 2J 07 14 21 05 12 19 26 03 10 17 24 01 08 


15 22 04 11 18 25 


P-+C sequence for B ___ 06 13 20 02 09 16 23 07 14 21 05 12 19 03 10 17 24 01 08 15 22 


04 11 18 25 


FIGURB d5b 


It is possible to superunpose these two sequences bv shifting the sections m lme B aiter certam 
numbers 
Thus 


.A. ... 06 13 20 27 02 09 16 23 07 14 21 05 12 u 26 03 10 17 24 01 08 15 22 04 ] 1 18 25 
B ... 06 13 20 D 02 09 16 23 07 14 21 05 12 19 D 03 10 17 24 01 08 15 22 04 11 18 25 


In the case of actual messages wrrespondmg to the foregomg P-+C sequences, superrmposit1on 
of the two texts m the manner md10ated would at once permit of a solution by anagrammmg of 
columns 
The unknown factor, of course, 18 the location of the blank spaces 
Where the two 
messages dllf er m length by only one or two letters bnef experrmentation would tell the story, 
where the messages dllf er m length by a good many letters the process would be much more 
difficult but not at all hopeless of fruitful results 
Only a small section of text reconstructed by 
anagrammmg will soon lead to complete solution 
Hence, it follows that by regulatmg the num- 
ber of blanks to be left here and there and Judicious shiftmg of sections of text, solution by super- 
rmposmg and anagrammmg homologous sections of text from several messages m the same trans- 
poSition key will often be possible 


55 


J The foregomg prmciples wtll naturally not be applicable to cases where two messages dllfer 


m length by but one letter and this small ddference brmgs about a profound ddference m the P-+C 
sequences applicable to the messages 
This is what happens often m the case of true double 
transposition,1 but the prmciple can nevertheless be applied even here 
.A.n explanation of the 
procedure hes beyond the scope of the present text, however, and no more will be mdicated herem 
concernmg the matter m the case of true double transposition 
However, m certam cases of 
combmed substitution-transposition to be discussed m a later portion of this text the prmciples 
elucidated m these last few subparagraphs may be found to be applicable 


27 Reconstruction of the keys m double transpos1t1on -a Havmg reconstructed the plam 
texts of the messages solved by superimposmg and anagrammmg, as explamed m paragraph 
26 d, e, can the transposition key be found? First, it is necessary to a"lc,ertam whether a smgle 
rolumnar transposition had been used and, if not, then the assumpt10n will he that a double 
transposition had been used 
b If a smgle transposition were the case, the relationship pomted out m paragraph 16c, con- 
cernmg the existence of a constant dllference between successive elements of the P-+C sequence, 
should obtam 
Havmg the 0-+P sequence, the P-+C sequence may readily be established by 
mversion of the former 
Hence, the P-+C sequence 18 constructed by mvers1on, as shown m 
figure36a 


Tenn number____ 
t 
2 
a 
' 
5 
6 
7 
s 
9 
10 
11 
12 
13 
14 
15 
16 
17 
1s 
19 
m 
21 


C-+P sequence ___ 28 
3 14 46 19 37 25 47 48 26 35 41 
2 34 27 
12 
d6 45 
17 13 40 


~ 
~ 
~ 
~ m w 
~ 
~ m 
& 
u 
~ H 
~ M 
~ 
$ 
» 
~ u 
~ 


18 
9 
24 33 
8 
1 
50 44 11 
30 51 
23 31 
22 
16 
7 
21 
32 42 
10 49 


434' 
<11146474114900111 


4 43 
15 
5 39 29 20 38 6 


Tenn number ____ 1 
2 
3 
' 
5 
6 
7 
s 
9 
10 
11 
12 
13 
H 
15 
16 
17 
18 
19 
m 
21 


P-+C sequence .•• 27 13 
2 43 46 51 
37 26 23 41 
30 16 20 
3 45 36 19 22 
5 49 38 


~ 
~ 
~ 
~ m w 
~ 
~ m & 
u 
~ H 
~ M 
~ $ 
» 
~ u 
~ 


35 33 24 
7 10 15 
1 48 31 
34 39 25 
14 11 
17 
6 50 47 21 
12 
40 


43 
44 
~ 
46 
~ 
411 
49 
M 
fil 


44 2q 18 
4 
8 
9 
42 
28 32 


FI017RB 3611 


c (1) Smee there appears to be no constant dllference between successive terms ill the 
P -+ C sequence m figure 36a, smgle columnar transposition is ruled out and double transposition 


IS assumed to have been employed 
In passmg, it is worthwhile notmg that the reconstruction 
of the keys employed m the case of true double transposition is qmte rmportant, because it is 
often the case that concentrated effort directed toward the cryptanalysis of one or more messages 
and the subsequent recovery of the transposition keys will, of course, greatly facilitate the 
readmg of all other messages m the same keys 
(2) There are at least four methods smted to the pmpose and they Will be dealt with m an 
order most conducive to their comprehension by the student 
(3) A. prelrmmary to the reconstruction of the keys m the case of each of the four methods 
to be studied consists m establishing or ascertammg the WJdth of either the T-1 or the T-2 
matnx, usually the former, because it is easier to do 


1 See Special Text No 166, Ad11anced Military Cryptography, sec IV 
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(4) As m paragraph 26h, the exposition wtll employ matnces m which the consecutive 
numbers 1, 2, 3, 
take the place of the successive plam-text letters m the T-1 matnx, 
because m such handling sigmficant facts ansmg from the mechamcs of encipherment are brought 
to hght 
d In order to study the effects of true double transposition on this matter of reconstructmg 
the keys an example will be employed, mvolvmg transposition with two different keys 
Let 
the "message" and the keys be as shown m figure 37a 


6 
2 
7 
Ii 
3 
8 
4 


01 02 03 04 05 06 07 08 
09 10 11 12 13 14 15 16 
17 18 19 20 21 22 23 24 
25 26 27 28 29 30 31 32 
33 34 35 36 37 38 39 40 
41 42 43 44 45 46 47 48 
49 50 51 I 


T-1 


3 
9 
7 
4 
2 
11 
8 
10 
6 
5 


04 12 20 28 36 44 02 10 18 26 34 
42 50 06 14 22 30 38 46 08 16 24 
32 40 48 05 13 21 29 37 45 01 09 
17 25 33 41 49 03 11 19 27 35 43 
51 01 15 23 31 39 47 I 


T-2 


Term number -- ------- - --- 
-- - - - - 
- - - - 
- 
01 
02 
ru 
04 
05 
06 
07 
08 
oo 
10 
11 
12 
13 
P ~ C sequence_ ----------------- --- __ 20 06 48 
33 
15 44 30 21 
03 
39 04 42 32 


Term number ___ _ 


U 
W 
W 
U 
IB 
~ 
~ 
~ 
~ 
23 
M 
25 
~ 


17 
51 
36 22 
13 49 
31 
34 24 
09 43 
26 
16 


~ 
28 
m 
~ 
fil 
~ 
~ 
M 
35 
00 
~ 
~ 
~ 
01 
35 28 
14 05 41 
23 
10 46 37 
19 
12 
50 


~ 
G 
~ 
~ 
« 
~ 
~ 
n 
@ 
~ 
m 
M 
40 25 07 
18 08 45 27 02 38 29 
11 
47 


------ 
- 
01 
02 
03 
04 
06 
06 
07 
08 
09 
JO 
11 
12 
13 


C ~ P sequence __ - ---------------------- 27 47 09 
11 
31 
02 42 44 
23 34 50 38 
18 


1' 
Iii 
16 
17 
18 
19 
i.1 
21 
~ 
23 
2' 
25 
~ 
30 05 26 
14 43 37 
01 
08 
17 33 22 41 
25 


~ 
28 
m 
00 
fil 
~ 
33 
M 
35 
36 
~ 
~ 
~ 


46 29 49 07 20 
13 04 21 
28 
16 36 48 
10 


~ 
G 
~ 
~ 
« 
~ 
~ 
n 
@ 
~ 
m 
fil 
40 32 
12 24 06 45 35 
51 
03 
19 39 
15 


FIGUBB 37a 


N othmg m the nature of a senes of constant differences between succesB'l.ve terms is now discermble 
m the P ~ C sequence 
But there is, as can readily be seen, a fairly constant relationship 


between segments or sections of this sequence 
For example, take the 1st to 6th terms of this 


P ~ C sequence (20 06 48 33 15), set them under the 29th to 34th terms (28 14 05 41 
23), and find the difference between supenmposed numbers 
(When the minuend is less than 
the subtrahend the supenmposed terms are disregarded ) Thus 
29th to 34th terms ____________________________________ 28 14 05 41 
23 
1st to 6th terms _________________________________________ 20 06 48 33 
15 


D1fferences-.• ---------------------------------------------8--8----8--8- 


,-. 


S.7 


There is a constant difference between the superimposed terms 
The reason for its appearance 


is not hard to understand if reference is made to figure 37a and the matter is studied m the hght 
of the mechanics of the method of enmpherment 
As for the two terms 28 and the 20, whtle 
they come from different columns m the T-2 matnx, both come from the same column of the 
T-1 matrix, as do 14 and 06, 41 and 33, 23 and 15 
But the 05 and the 48 not only come from 


different columns m the T-2 matnx, but also from different columns m the T-1 matrix, this 
1epresentmg a case where there is a transit from the bottom of one column to the top of the next 
column m the transposition process 
Now the constant difference is m this case 8 because 
the superimposed terms happen to be sequent m the columns m which they fall m the T-1 matrix 
If the supenmposed terms arc m the same column m the T-1 matrix but separated by one row, 
the constant difference will be 16, if separated by two rows, the constant difference will be 24, 
and so on 
Thus, for example 
6th to 11th terms____________ _ __ _ ---------------- 44 30 21 
03 
39 
29th to 34th terms_ --------------------- -------------- 28 14 05 41 
23 
16 
16 
16 
16 
Here the difference, 16, lS a milltiple of 8 because the supenmposed terms are separated by one 
row m the T-1 matnx, as can be seen by referring to figure 37a 


e The foregomg phenomena afford a method of ascertammg the width of the T-1 matnx 


man unknown case, and, as noted above, this constitutes the first step m recovering the transpoSI- 
tion key or keys 
For rl a study be made of the terms of the P ~ C sequence m figure 36a, 
based upon findmg sections thereof which show a constant difference, the latter will correspond 
to either the width of the T-1 matnx or a milltiple of the width 
An easy way to make this 


study is to take a section of the P ~ C sequence m figure 36a, add 5, 6, 7, 
(m successive 
steps) to each term of the selected section, and then look for repetitions between the origmal 
P ~ C sequence and tl>e P ~ C sequence plus the additive 
A begmnmg will be made with an 
assumption of a T-1 matrix of 5 columns 
Smee the cryptograms conte.m only 51 letters, all 
totals greater than 51 will be disregarded 
Hence it is best to take a section which has a long 


series of low numbers, so that when the additive is applied the ma]ority of the totals will not 
exceed 51 
Such a series is the followmg (only one term m it, the 29th, is close to the maximum) 


Term number____ _ 
- - 
21 
~ 
23 
2' 
25 
~ 
~ 
28 
m 
oo 
31 
32 
33 
M 
35 
36 
37 
P ~ C sequence ______ 38 35 33 24 07 10 15 01 48 31 34 39 25 14 11 
17 06 


P~Csequence+5 ___ 43 40 38 29 
12 15 20 06 
36 39 44 30 19 16 22 11 


Searchmg for repetitions between the P~C sequence and the P~c sequence +5, the results are 
negative 
Trial is then made of additives 6 to 11, mclusive, with srmtlar negative results When 
an additive of 12 is applied, however, the results obtamed give positive mdication that the T-1 
matrix is 12 columns m width 
Thus 
Term number ____________ --- - - 
21 
22 
2d 
24 
211 
26 
27 
28 
29 
30 
31 
32 
33 
34 
35 
36 
37 


P~c sequence ___________ 38 35 33 24 07 10 15 01 48 31 34 39 25 14 11 17 06 
P~c sequence +12 _____ 50 47 45 36 19 22 27 13 
43 46 51 37 26 23 29 18 
It wiJl be seen, on referring to figure 36a, that the followmg repetitions (with the term numbers m 
each of the sequences md1cated) are present 


Term DO ID P~C sequence+ 12 
21 
221123 
24 
211 
26 1127 
28 
29 
30 
31 
32 
33 
34 
35 ,, 36 
37 
Repetitions___________ ____ 
5:..:0=---=4..:...7~45=---=-3-=-6--=1-=-9_2_2-!! 
1 ~2....:.7_1_3_0_2_4_3 __ 
4_6 _5_1_3_7_2....:.6_2-=3~2..:...9=--=18 


Term no m P~C sequence 
38 
391115 
16 
17 
1811 01 
02 
03 
04 
05 
06 
07 
08 
0911 '' 
45 


The width of the T-1 matnx is therefore 12 and its outlmes may at once be drawn, smce the total 
number of letters m each message, 51, mdicates that there are 3 long columns of 5 letters and 9 
short columns of 4 letters 
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f (1) There is another method of ascertaining the width of the T-1 matrix, which is perhaps 


a bit shorter and more direct than that described above 
Basically both m<.'thods are the same, 
the one now to be presented bemg but another way of lookmg at the matter 
Suppose that the 


differences between successive terms m the P4C sequence of figure 37a are calculated and set 
down as shown below, and then repetitions are sought m the senes of differences, the latter 
const1tutmg what will heremafter be termed the P---+O interval sequence 
Thus 


Term number ___ __ 
__ ____ 
01 
20 
03 
04 
05 
06 
01 
os 
09 
10 
11 
12 
1a 
14 
16 


P---+C sequence ______________ 20 
06 
48 
33 
15 44 
30 
21 
03 
39 04 
42 
32 
17 
51 


P---+C mterval seqlwnce __ -14+42-15-18+29-14 -9-18+36-35+38-10-15+34-15 


Term number___ ___ _ _______ 
16 
11 
1s 
19 
20 
21 
22 
23 
24 
P---+C sequence __ ----------- 36 22 
13 
49 
31 
34 24 09 
43 


P---+C mterval sequence___ -14 -9 + 36 -18 + 3 -10 -15 + 34 -17 


Term number 
__ ------------- _ ___ ___ 
25 
26 
21 
28 
29 
30 
31 
32 
33 
34 
ss 
36 
37 


P---+C sequence_ ------------------------- 26 
16 
01 
35 28 
14 05 
41 
23 
10 46 37 
19 


P---+C mterval sequence _______________ -10-15+34 -7-14 -9+36-18-13+36 -9-12 -7 


Term number__ _ _ __ ---------------- 
38 
39 
40 
41 
42 
43 
44 
45 
46 
47 
48 
49 
50 
51 
P---+C sequence _ _ _______ ---------- 12 
50 40 25 07 
18 08 45 
27 
02 
38 29 
11 
47 


P---+C mterval sequence __________ +38-10-15-18+11-10 +37-18-25 +36 -9-18+36 


F'IGUBB 17b 


Several repetitions are noted and underscored, m the same manner that ordmary repetitions are 
md1cated m analogous cryptanalytic procedure 
Now take the longest repetition, -14-9+36 
-18, and find the terms from which it or1g:mates m the P---+C sequence, a constant difference of 
8 will be found 
Thus 
(Term numbers 16-20) ________________ ------------- 36 22 
13 49 31 


(Term numbers 29-33) _________ ---------------------- 28 
14 05 41 
23 
D1ff erences_______________________________ 
_ ____ ------- 
8 
8 
8 
8 
8 


The other repetitions will show the same constant difference 
The terms which produce the 


repet1t10ns will be found to be located m thr sanw columns of the T-2 matnx m figure 37a, and 
reference to that figure w11J show that the constant difference between the sets of terms producmg 
repetitions m th£. P---+C mtervnl seqm•nee 1s merely the result of the mechanics of enc1pherment 
(2) In s1m1lar manner, if the mterval sequl'nce is constructed for the P---+C sequence of 
figure 36a, the repet1t10ns underscored m figure 36b are noted 


Term number ____________ 
01 
02 
03 
o• 
05 
06 
01 
08 
o9 
10 
11 
12 
13 
H 
u 
P---+C sequence __ ----------- 27 
13 
02 43 46 
51 
37 26 
23 
41 
30 16 20 03 
45 


P---+C mterval sequence __ -14-11 +41 +3 +5-14-11 -3+18-11-14 +4-17 +42 -9 
Term number _________________ 
1e 
17 
18 
19 
20 
21 
22 
2a 
24 
P---+C sequence _______________ 36 
19 22 
05 49 
38 35 33 24 


P---+C mterval sequence __ -17 +3-17+44-11 -3 -2 -9-17 


Term number ________ ------- 
26 
26 
21 
28 
29 
30 
31 
32 
33 
34 
35 
36 
37 
38 
3u 
P---+C sequence___ _______ __ 07 
10 15 
01 
48 31 
34 39 25 
14 
11 
17 06 50 47 


P---+C mterval sequence __ 
+3 +5-14+47-17 +3 +5-14-11 -3 +8-11+44 -3-26 


Term number_____ __ _______ 
40 
41 
42 
43 
u 
45 
46 
47 
48 
49 
50 
61 


P---+C sequence ______________ 21 
12 40 44 29 
18 04 08 09 42 28 32 


P---+C mterval sequence___ 
-9 +28 +4-15-11-14 +4 +1 +33-16 +4 


FIGUBB 86b 
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Takmg the sections of the P---+C sequence from which the longest repetition anses and findmg 
the constant difference between the terms mvolved, a width of 12 for the T-1 matnx is md1eated 
Thus 
(Term numbers 04-09) _______ ----------- --- 43 46 51 
37 26 23 
(Term numbers 30-35) ________ ----------- -- 31 
34 39 25 
14 
11 


Differences ----------------- --------------------- 
12 
12 
12 
12 
12 
12 


Tlus is identical with the results found by tho other method 
The T-1 matrix for the messages 
of paragraph 26d 1s th<.'refore 12 columns m width 


g Havmg ascertamed the width of the T-1 matnx, the next step 1s to ascertam whether 
the width of the T-2 matrix is the same as that for the T-1, or different 
If the same, the sus- 


pic10n is warranted that the transposition keys for both matnces may be 1dent1cal1 m which case 
it is necessary to recover but one key If the widths of the two matnces are different, then 
1t 1s obvious that two different transpos1t1on keys are mvolved 
Havmg ascPrtamed the widths 


of both matnces, one can proceed to reconstruct the transposition key or keys whwh apply 
thereto 
There are, as stated once before, at least four methods smtable for tlus purpose 
They 


will now be taken up m tum, and each method will be explamed m detail 


h (1) In explammg the first method the discussion will be m1tiated with a recons1derat10n 


of figure 37a If the 0---+P sequence estabhshed m that figure IS treated as though it weie plam 
text and enciphered by the double transpos1t10n method, usmg the same two transpos1t1on keys 
as before, an mterestmg phenomenon is observed 
:Not the following (fig 37c) 


6 
2 
7 
5 
3 
8 
4 


27 47 09 11 31 02 42 44 
23 34 50 38 18 30 05 26 
14 43 37 01 08 17 33 22 
41 25 46 29 49 07 20 13 
04 21 28 16 36 48 10 40 
32 12 24 06 45 35 51 03 
19 39 15 I 


T-1 


3 
9 
7421181066 


11 38 01 29 16 06 47 34 43 25 21 
12 39 02 30 17 07 48 35 44 26 22 
13 40 03 31 18 08 49 36 45 27 23 
14 41 04 32 19 09 50 37 46 28 24 
15 42 05 33 20 10 51r--.--- 


T-2 


FJGUBB 37c 


Here it is seen that the numbers m the columns of the T-2 matnx are consecutive 
Obv10usly1 1f 
the columns of this T-2 matrn: were retranscr1bed ma matrix of the same outlmes as the T-1 
matnx, the numbPrs would be con~ecut1ve m ro\\-s and would 1epresent the plam-text sequence 
1, 2, 3, 
, msenbed w1thm a T-1 matrix m the normal fashion 
Thus (fig 37d) 


6 
2 
7 
5 
3 
8 
4 


01 
02 
03 
04 
05 
06 
07 08 
09 
10 
11 
12 
13 
14 
15 16 
17 
18 
19 20 21 
22 
23 
24 
25 26 27 28 29 30 31 
32 
33 34 35 36 37 38 39 40 
41 
42 43 44 45 46 47 48 
49 50 
51 I 


FIGUBB 37d 


I 
I 
I 
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The result of these three steps has been to effect a return to the ongmal T-1 matrIX contammg 
plam text m normal sequence 
The pnncipal pomt to be noted here is the appearance of the 
T-2 matnx m figure 37c, for it is the basis of the first method for recovermg the transposition 
keys, as well as for other operations m connection with double transposition 


(2) To demonstrate the procedure, the data afforded by figure 37a agam will be employed 
Let the c~P sequence be mscnbed withm a matrix of 8 columns (the ~1dth havmg been estab- 
hshecl by one of the methods set forth m subpa1s d-f) 
Thus 


2 
3 
4 
6 
6 
7 
8 


27 47 09 
11 
31 
02 42 44 
23 
34 
50 
38 
18 
30 05 26 
14 43 
37 01 
08 
17 
33 22 
41 
25 46 29 49 07 
20 
13 


04 
21 
28 
16 
36 48 10 40 


32 
12 
24 
06 45 35 
51 
03 


19 39 15 I 


FIGUBB 37e 


Fmd the column m whwh term 01 appears and set that column down horizontally, placmg a 
vertical bar before and after the senes of numbers to set them off as belongmg to one column 


Step (1) 
111 
38 01 
29 
16 
06 I 


FIGUB.li 37/ (1) 


Then find the column m which the term 02 appears and set it down under the row of numbers 
given m StPp (1) 
Thus 


I 11 
38 o 1 29 
16 
06 I 
Step (2) 
I 02 
30 
11 01 
48 35 I 


F1GUBB 37/ (2) 


Note the a.scendmg supenmposed numbers 01, 02, 29, 30, 16, 17, 06, 07 
Contmue to build up 
on this structure m the manner depi<1ted m successive steps as follows 


111 
38 01 
29 
16 
06 I 


Step (3) 
I 02 
30 17 07 48 
35 I 
I 44 
26 
22 
13 
40 03 I 
111 
38 01 
29 
16 06 I 


Step (4) 
I 02 
30 17 07 
48 35 I 
I 44 26 
22 
13 
40 03 I 
J 27 23 
14 41 
04 32 
19 I 
111 
38 01 
29 
16 06 I 
I 02 
30 17 07 48 35 I 


Step (5) 
I 44 26 22 
13 
40 03 I 
J 27 
23 
14 41 
04 32 
19 I 


J 42 05 
33 
20 10 
51 I 


FIGURB 37/ (3) (4) (5) 


The numbers 01 to 05, mclusive, here have formed the basis for butldmg up the structure shown 
as Step (5) 
The next term ID the sequence is 06 but it is already m the structure, as is also 07 
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In the column m which 06 and 07 appeal tlwre is JUbt room enough foi 08 and 09, smc,e the teim 
10 1s already shown at the bottom of the column 
Hence 


8t1'p (h) 


8tep (7) 


Step (8) 


111 38 01 29 lb 061 
102 30 17 07 48 351 
144 26 22 13 40 01131 18 08 49 16 451 
121 23 14 41 04 32 191 
142 05 33 20 10 511 


111 38 01 29 16 061 
102 30 17 07 48 351 
144 2b 22 13 40 03131 18 08 49 36 451 
127 23 14 41 04 32 19109 50 37 4b 28 24 151 
142 05 33 20 10 511 
111 18 01 29 16 061 
147 M 43 25 21 12 39102 30 17 07 48 351 
144 26 22 13 40 03j31 18 08 49 36 451 
121 21 14 41 04 32 19109 50 37 46 28 24 151 
142 05 33 20 10 51 I 


~!Gt.RE 3i/(6) (7) (8) 


The process is contmued m tlus mannei until, as shown m figure 37j(9), all the numbers of the 


c~P sPquence have bl.'1.'Il platl'd 
(Here tlw la'!t number IS 51 ) 


111 38 01 2q 16 06147 34 43 25 21 12 391 
147 34 43 25 21 12 39102 30 17 07 48 35144 26 22 lJ 40 031 


Step (9) 
144 26 22 13 40 03131 18 08 49 36 45127 23 14 41 04 32 191 
127 23 14 41 04 32 19109 50 37 46 28 24 151 
109 50 37 4b 28 24 15142 05 33 20 10 511 


FIGURE 37/ (9) 


The T-2 mah I'\. may now be drawn w1thm the confinps of the '!tru<-tur<' shown m this last figure 
The poSitions of vertical Imes to be placed at the left and right to ma1k tlw e~act outlmes of the 
matnx may now readily be found by refPrrmg to thl' matux m figure J7e 
It 1s obvious that the 
column with tlw tprms 11-15 belonb"B at the l'Xtreme left of the T-2 matrt'C, the column with the 
terms 21-24 belongs at the P~treme right 
The transposition key f01 the matrix may then be 


established directly from the matn'\. itsPlf, by following the sequence of numbers m the columns 
Thuo;i 


124H'i-41-5 


~9 
74211810ff5 


11 J8 01 29 16 06147 34 4J 25 21 12 391 
147 34 43 25 21 12 39J02 30 17 07 48 35144 2b 22 13 40 031 
144 26 22 13 40 03131 18 08 49 36 45127 23 14 41 04 32 191 
127 23 14 41 04 32 19109 50 37 46 28 24 151 
109 50 37 46 28 24 15J42 05 33 20 10 51 I 


~IGURE 3ig 


I I 
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Reference to hgure J7c will show the rxact Wirl'Spon<lence between the T-2 transpos1t1011 key 
and the T-2 matnx of figure J7g '\\1th thesP same elements md1cated m figure 37c 
The trans- 
poSltlon key for the T-1 matnx m figure 37e can now easily be denved from figure 37g 
It 
must be as follows 
6 
2 
7 
6 
3 
8 
' 


27 
47 09 
11 
Jl 02 
42 44 
23 
J4 50 
,J8 
18 
JO 
05 
26 
14 4J J7 
01 
08 
17 
.M 
22 
41 
25 
46 
29 
49 07 
20 
13 


04 
21 
28 
lb 
Jh 
48 
10 
40 


32 
12 
24 
06 
45 
J5 51 
03 


19 
39 
15 I 


FIGURB 37h, 


This tianspos1t1on kPy .. md T-1 mntrn. aie identHal with th<' key and T-1 matri:x of figurn J7c 


i 
Note tlw apphcahon of the fou•gomg m('thod to tl1(' c~p sequence c;;hown m figure 36a 
m connpc,hon "1th the mcf>sages solved m parngraph 26d-e 
It has alH•.i.clv been found that the 
width of the T-1 matux lS 12 
Th(' c~P SPQUC'Jl<'e of figure• 36a IS thercforr mscnbed w1thm a 


matnx of 12 columns 


2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 


28 
OJ 
14 
46 
19 
J7 
25 
47 
48 
26 
,J.) 
41 


02 
J4 27 
12 .rn 
45 
17 
16 
40 
18 
09 
24 


J~ 08 
01 
50 
44 
11 
30 
51 
23 
31 
22 
lb 


07 
21 
~2 42 
10 
49 
04 
4'3 
15 
05 
39 
29 


20 
38 06 I 


l'I< Lilli 'I& 


The process explaml'd m bUbpa.iagrnph h (2) above ts no" apphPd 
The successive steps have 
been omitted hut tllt' final H••mlt is <Jiown h"rc•w1th 


J 14 
27 
()1 
32 
06 J 19 
3b 
44 
10 I 


J 48 40 
23 
15 I 28 
02 
33" 07 
20 I 37 
45 
11 
49 I 


I 41 
24 
lb 29 I 03 
34 08 
21 
38 I 46 
12 
50 
42 I 


J 25 
17 
JO 
04 I J5 09 
22 
39 I 47 
13 
51 
43 I 


J 26 
18 
.H 
05 I 


~IGUR.11. 36d 


All thl' numbl•rs fioxn 01 to 51, mdusn<', are contumrd w1thm ih1b structu1c 
Extendmg ii to 
the lPft or right to make the T-2 matnx complete, by iefcirmg to the T-1 matrix, it Is found 
that thP c;;tructurc must be made as shown hcu•with 


J 48 40 
23 


J 41 
24 


J 25 


J 26 


4 
8 


14 
27 
01 
32 
15 J 28 
02 
33 
16 29 I 03 
J4 


17 
30 04 I 35 
18 
31 
051 


2 
6 
9 
11 


06 J 19 
Jb 44 


07 
20 I 37 
45 


08 
21 
38 I 46 


09 
22 
39 I 47 


FIGURB 'l6t 


3 
12 
10 
6 


10 I 48 4o 2J 
11 
49 J 41 
24 
12 
50 
42 J 25 
13 
51 
43 I 26 


15 I 
16 29 I 
17 
30 04 I 


18 
31 os I 
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The transposition key for thP T-1 matnx is now found to be as md1cated at the top of figure 36e 


J A sewnd method for reconstructmg the keys will now be explamed 
To demonstrate 


this mPthod the data affo1ded by figure 37a will agam be employed 
Gomg back to the pomt 
where the P~C mterval sequence for this example was established m subparagraphf(l) above, 
the terms, m figme 376, winch gav" nse to the thnce-appeaung rPpPt1t1on m the mterval sequence 
(-10 - 15 + 34) are found to b<· ab follm~ b 
1'.t appearnuc,e (tt>1m numbeu. 12-16)_ 
__ _ _ 
__ 42 
J2 
17 
51 
2d appeR.lance (term numbers 21-25) ____________ .H 24 09 43 
3d appenrance (tc>rm numb"rs 25-29) _ _ 
_ ________ 26 
16 
01 
35 


FIGURB 371 


These sequences may be ieartangPd so ns to bung the numbe1s m ascendmg order withm 
columns 
Thus 
26 
16 
01 
3.3 
34 
24 
09 4J 


42 
32 
17 
51 


FIGUBB 37} 


The constant differenw, 8, w1thm the columns of this structure is, of course, the same constant 
difference as was found before, and corresponds with the width of the T-1 matnx 
It derives 


from the T-1 matrix, as may be sPeil on iefeITmg to figure 37a 
The columns of the structure 


m figure 37J ar" seen to be p01hons of th" T-1 matrix, lymg m the followmg positions m that 
matri"C 


01 
09 
17 
26 
34 J5 
42 
43 


16 
24 
32 


...... ~~~~~~~~~~-- 
51 I 


FIGUBB d7/I 


In the T-2 matru .. these numbers fall m the followmg positions 


26 
42 
16 
32 
01 


17 
35 
51 
I 


FIGUBB 371 


34 
24 
09 
43 


Now if the drmens1ons of the T-2 matrix were unknown, these numbers could nevertheless be 
placed m a skelctom?ed T-2 matux us followc;; 


26 
34 42 
16 24 32 
01 
09 
17 


35 43 
51 


FIGl111B 37m(l) 


' 
I 
I 


and the block of numbers could h<> extt>nded on both •ndes by referrmg to the T-1 matrix m figure 
37a 
Thuc; 
I 02 
10 
18 
26 
34 
42 
50 
I 08 
16 
24 
32 
40 48 I 
01 
09 
17 
25 
33 
41 
4q I 


! Ol 
11 
19 
27 
35 4J 
51 


}< IGUKE 17m(2) 


Tlns stlu<'tur<> may ne'\t he e'\.tPndt•d by ll'f<•rrm~ to tlw P-C' sequence m figure 37a, by <'om- 
plPtmj?; the pn1 ttal colnmn'I of th<' c;t1 m tuH' 


44 I 02 
10 18 
26 
J4 42 
50 
06 
14 
22 


30 
38 
46 I 08 
16 
24 
32 
40 48 I 05 lJ 


21 
29 
37 
45 
01 
09 
17 
25 
.. J3 
41 
49 


101 
11 
1q 
27 
35 43 
51 
07 
15 
23 
31 


}< IGUBE 177ti(3) 


Agam the structme may h<• <>xtend<>d bv I<'f<>irmg to the T-1 matrix 
Thus 


04 
12 
20 
28 
J6 44 
02 
]() 
18 
26 
34 
42 
50 
06 
14 
22 
JO 
38 46 


06 
14 
22 
30 38 46 
08 
16 
24 
32 
40 48 
05 
13 
21 
29 
37 45 


05 
H 
21 
29 
J7 45 
01 
09 
17 
25 
33 
41 
49 


03 
11 
1q 
27 
35 43 
51 
07 
15 
23 Jl 39 47 


I< iGURI! ~im(4l 


N otmg LlH' J.}>peiuance of th<' tt•1 m Ob m the ht IO\\ and n}qo m tlw 2d 10\\ of the sti U<'tUI <>, thf' 
lattl'r may be trnnscubed as follo\\s 


04 
12 
20 
28 
36 44 
42 
50 
06 
14 
22 
30 
J2 40 48 
05 
H 
21 
17 
25 
H 
41 
49 
03 


51 
07 
15 
2.{ 
31 
J9 


02 
10 
JS 46 
29 
37 
11 
19 


471 


18 
26 
34 


08 
16 
24 
45 
01 
09 


27 
35 4.l 


l<!GUKI! 17m (5) 


42 
50 
06 
14 
22 
30 J8 46 
32 
40 48 
05 
13 
21 
29 
37 
45 
17 
25 3J 41 
49 
51 
07 
15 2l 31 
l9 47 


By referrmg to tlw T-1 matux of figure 37a an<l tlw for<>gomg structm<>, the key fo1 T- 1 can h<' 
recover(•d 
It 1r. 6-2-7-1-5-3-8-4 
By rdeirmg to the P-C sPqm•nct' m hgure 37a tht• kPy 


fo1 thP T-2 matrn: JUi.t construct<>d may ht• cstabhslwd 
It is 3-9-1-7-4-2-11-8-10--6-5 


!.. Applymg tlus method to the m<>ssnges soh C'd m paragraph 26d-e, tlU' steps arc as follo\\s 
The \Hdth of the T-1 m.ttnx has been estabhshC'd aq bcmg 12 
The P-C mtrrval sC'quencP m 
figure 36b qhows the rPpet1t1on +3 +5 -14 -11 -3 appearmg two 
time~, the rC'pet1t10n 


+3+5-14 appearmg tlnre times, and therepet1t10u -14-llappC'armgthrertnnes 
The 
tem1s g1vmg r1s<' to these rep(•t1tions are arranged ma structure with ascendmg numbers w1thm 
the columns 
Thu~ 
07 
10 
15 
01 


27 
1J 02 


31 
34 39 25 
14 
11 


4J 46 
51 
.37 
2fi 
23 


FIGUBI! J6f 
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The const.mt ddfPH'nce, 12, md1cJ.tPs a T-1 matrix of 12 <'olumns 
Th<• mntu'\ i<.i pu•paied 


2 
4 
5 
6 
8 
9 
10 
11 
12 


01 
02 
03 
04 
0.3 
06 
07 
08 
09 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
2q 
JO 
31 
32 
33 
34 
35 
3G 


37 
38 3q 40 
41 
42 
4.l 
44 
41> 
46 
47 
48 
49 
50 
.11 


J<IC't.Rll' 'lllll 


The term~ \\1thm the columns of tlw i.trncturP m hgure Jbf au• trnni.cnbe<l mto ro\\<.i (of the 
skeletomzed T-2 matrix) 
Oi 
JI 4.l 
10 
J4 46 


1.) 27 
39 
51 


01 
lJ 25 
37 


02 
14 
26 
11 
23 


1' IG\.K& 36h(l) 


This stru<'tUJC' is e'l:tended by refernng to tlw T-1 m.1t11x (h(!ure 36g) 


2 
3 
4 
6 
6 
7 


1 
07 
}<} 
31 
43 
2 
10 2? 
H 
46 
3 
OJ 
15 2i 39 
51 
4 
01 
13 
25 
37 
49 


3 
02 
14 
26 
38 
50 
0 
11 
2J 
3'> 
47 


FIGLl I! .l8/i(2) 


Notmg that tlw untull termc; of the P-C sequence m hgUI<' J6a (27 
13 
02) 1110 p1escnt m 
this structur<> (m the 3d c.olumn) this gives thf' top of the T-2 matnx as t0mc1dmg with the 3d 
row of the structure 
Th<:' P-C sequmce m figur(' 36a r<•ads 27 
13 
02 
43 
46 
, the 
43 and 46 art' al'lo m the stru<'turr m figure 36/1 (2) m the 1st and 2d rows, column 5, hence the 
structure m figurl:' 36h"(2) ean b1• rC'arrangecl thus 


o~ 15 
21 
39 
51 
01 
lJ 25 J7 49 
02 
14 
26 
38 
~o 
07 
19 
31 
43 
11 
23 
35 
47 


10 
22 
34 
46 


l<JC'URK 36h(3) 


Tht• i.trudure may now he extended by rrfe11mg to the> P-C ~equenc<> m figure 36a 


35 03 
15 27 
.l9 
51 
05 
17 


33 
45 
01 
13 
25 
37 
49 06 


24 
36 
48 02 
14 26 
38 50 
07 
19 
31 
4l 
11 
23 
35 47 


10 22 
34 46 


1' l<'l'Kll' 36h ( 4) 


Thus, bv refernng alternately to the P~c sequence and the T-1 matr1'\ the strn<-ture 1s extended 
to the followmg 


35 
33 
24 
07 
10 


03 
15 
27 
3q 


45 I 01 
13 
25 


&t> 
48 I 02 
14 
19 
31 
43 111 


22 
34 46 I 


51 I 05 
17 
29 
37 49 I 06 
18 
26 
38 
50 I 04 


23 
35 47 I 08 


FIGURE 3611(5) 


41 I 09 
21 
33 


30 42 I 12 24 
lh 28 
40 I 01 
20 
'32 
44 110 


45 I 
36 
48 I 


19 
31 
4J I 


22 
34 
46 I 


It will be noted that the first number to the 11ght of < 
1J.d1 vP1tirnl bur 1s one of the numbers from 
1to12, md1catmg that nll the columns of the T-1 matru .. are now rPprl'~entcd m the T-2 structure 
It 1s now eai.y to vrnte the transpos1t10n key over the T-1 matnx 4-7-1-8-2-5-Q-11-3-12-10-6 
By followmg the numberi. m the P~c sequenre th<' trunspos1tion kl'y for the T-2 matrix is 
given directly, 1t 1s the same as for thl' T-1 matnx 
l (1) A tlnrd method for reconstrnctmg the trnnspos1t10n keys \\-111 no" be1 sc't forth 
It 
wtll first be explamPd m ronnection with thP artificml nample m figure 37a 
It has beC'n noted 
how the width of the T-1 mntnx cu.n be nscertamed from a '>tudv of the P-C sequence, tho work 
m comwct1on \\1th figure 37a nud subparngraph e give nn mchcJ.ted V\1dth of 8 for the T-1 matn::1. 
m this case 
(2) Let the add1t1ve 8 (found m subpa1s d 1111dj) be applied to the entire P~C sequencP of 
figure 37a, and then let the 1dentit1es between the two sequences be underscored and numbered, 
as shown m figure 37n 


(A) P~c sequence -------------- { 20 


36 


06 
48 33 
15144 30 21 
03 
39J04142 32 
11 
51 I 


\ 
J. 
3 
22 
13 
49 
'31114 
24 
oq I 43 I 26 16 01 
351 
4 
6 
6 
___ 
_;;,_....;4..;_1 _23~110 46 37 
19 I 12 150 40 25 
01 I 


8 
28 
14 05 


7 
9 
__ 
...,.,... __ 
2_1 I 02 18 29 
11 
47 I 
18 08 45 


10 
11 


(B) P~c sequence+8 ____ -----{ 28 
14 
56 
1 
'38 
29 
2 
41 
2315_2 __ 
__;,,,__l;_l ~47....:112150 40 25 
59 I 


;I 


44 
'30 
21 
32 
17 
57 
39 142 
51 I '34 24 09 I 47 


4 
6 
6 
36 
22 
13 
7 
54 
45 
8 
49 
31 jl8 
271 20 58 48 
33 
151 
9 


26 
16 
53 
_____ 
3_5110 
46 
37 
19 
55 I 


10 
11 


FIOURB37n 


If now the prol'edure PxplamPd m paragiaph 16k, 24c to j, and 25i toe is apphed to the repetitions 
noted m figure 3711, 1t be<'omes dear that the T-2mat11x m tins cMe must have 11 <'olumns 
Th<' 


transposition key for that matnx is then established, as follows 
2 


B 
1 
2 
A 
-- -- ---- - -- --- 
7 
11 


Cham __ - 
---- - -- 
1 
7 


3 
4 
9 
2 
4 
2 


.') 
J 
1 1 


6 
7 
8 
5 
4 
10 


8 
10 
6 


q 
10 
11 
1 
6 
8 
.) 
3 
q 


2 It I<; to be noted that thE' B sequ(,nce (that I'l, the P~C ~equencc plu~ the add1tne) mu~t be u .. ed as the 


base, othel"\\ 1sp the cham of Pqm' alE'ntf; \\ 111 hi' a re11Pr~ol of thE' correl't cham 
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This 1s a cyclic pPrmutation of thl key for th(, T-2 matrix, to obtcun the actual l ... Py it is ne<'cs•mry 
meiely to fix the pos1t1on of on<' 0f thl' l ... 11v numbe1s \\1th rl'spect to the m,ttr1::1. 
It is easy to 
find winch number belongs at the extreme ll'ft 01 e'\tremo right of tlw mntn'\ 
OnJy a fp" 


mmutes expernnentnt1on \\1th th<' kl'y uncl the T-2 mntr1x g1vl'i. thl' <'OrH•C't ~ta1 tmg pomt for 
the key, which 1s found to be 3-9-1-7-4-2-11-8-10-b-5 
(3) The 1ccovmy of thl' transposition kt>y for the T-1 mntrix 1.., no\'\ a '>lntple matter 
Its 


wulth hnvmg bl'l'n established as 8 columnc;, a ml'Ie trimstr1phon of the P~c 
~l'quen<'t. numbers 


f10m the T-2 matnx mto the T-1 mntrix g1vc•s tlw J...py 6-2-7-1-5-3-8-4 
The tV\o kPys and 


matnC'es are found to be 1hff Prmt 


(4) The p1ocedme sPt forth m tlus subpaiagraph is apphrnbll' without mod1hcat1on to the 


ra~P wh<'rl' thP two trnnspos1bon matnees arl' the same and have the same tianspos1t1on key 
This will bP notC'd m the followmg dPmonc;trat10n of the recoVl'IY of the matnces and kPyc;i fo1 
th<' message~ solved m pnr.1grnph 26d and P by anagrammmg 
It hac;i nheady been shown how 
the '\\Idth of the T-1 matrrx was MCC'rtmnc•d ac;i hemg 12 C'Olumns c~ubpar n The acld1t1ve 12 
is thPn applied to the entul' P~C sequeml', 1dt•nt1tw .. arl' Pstabh~lwd between s<'ct10n~ of th<' 
or1gmal sequen<'e and sections of tlw ~eq1IPnce + 12, and thPse 1denhcttl sect10ns a1e equatPd m 
the usual manner, leadmg to the establishment of a (,y<.h<' pcrrnutat1on of thC' transpoq1t10n kPy 
f01 the T-2 matrn: 
Thus (fig '36i) 


A 
B 


(p-+ C sequence) --- 
- - ---- 27 


(P--->C sequence+ 12)_ 
- - - 39 


03 
15 


15 
27 


21 
33 


B _ _ ___ 
___ 
__ _ 1 2 


A_ ------------ _ 
_ 8 5 


Cham _ 
-------- 1 8 


1 
l 
3 
13 02 43 46 
51 
37 26 23 41 
30 


25 
14 5.; 58 63 
49 38 35 53 
42 


2 
J 


4 
5 
b 


45 3b 
19 22 05 
4q 38 35 33 21 
57 48 
31 
34 
17 
61 
50 47 45 36 
4 
5 
6 


7 
8 
9 


01 
48 31 
34 39 25 
14 
11 
17 06 


13 
60 43 46 
31 
37 26 23 29 
18 
7 
8 
9 


10 
11 
12 
12 40 44 29 
18 04 08 09 42 28 
24 52 56 
41 
30 16 20 21 
54 40 


10 
11 
12 
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3 
4 
5 
6 
7 
12 
7 
9 
4 
1 


25<}11'3 


8 
9 
10 
11 
12 
2 
11 
6 
3 
10 


12 
10 
6 
4 
7 


16 20 
28 32 


07 
10 


19 22 


50 47 
62 59 


32 
44 


Smee sections 1, 4, and 7 of the P~C sequence• contam 5 terms (=long columni.), the othn 
c;iect1ons onlv 4 (=~hort columns), It follo"'s that the key numbers 4-7-1 go to the left and the 
actual key for the T-2 matnx Is 4-7-1-8-2-5-4-11-3-12-10-6 
Sm<'<' thP number of elements 
m this kPy IS the samr Mm the key for the T-1 matrrx, it is likely that the same key i~ employed 
for both transpos1t10ni. 
Simple experiment will qmckly veufy this assumpt10n and the trans- 


poSit1on matr1rP~ for thP firc;t of thr I) ml'~~agpc; of paral?J'aph 26d may hP c;ppn m t.hl' followmg 
(figurP '361) 
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4 
7 
8 
2 
9 
11 
3 
12 
10 
6 


t 
, Is 
4 
6 
8 
7 
8 I 9 
10 
11 
11 


H 
A 
V 
E 
0 
R 
D 


~-1~ 


E 
D R 


~- ---------- 
" 
14 
16 
16 
17 
18 
19 
IO 
Bl 
II " 
14 
A 
T 
I 
0 
N w A 
G 
0 
N s 
0 
---------------------,_ 


116 
BB 
t7 
18 
19 
80 
,1 
31 " 
'4 
36 
38 
T-1 


F 
F 
I 
R s 
T s 
Q u 
A 
D R 
---- 


s9T ( o-l41G ;--;--1:-;--;------ 


'7 
38 
41 
48 
0 
N 
0 
LID EJN v 
I 


..---- 


UI 


L 


60 
161 
L 
E 


C1yptogram_ _ 


P~c sequl'nce 


T-2 


4 
i 
I 
8 
l 
5 
II 
11 
3 
12 
10 
b 


s 
116 
111 
1,9 
In 
II ~ 
In 
ID 
41 
9 
111 
/IS 
V I 
I 
T 
E 
0 
N S 
G R 
0 
U 


;--1-1-,-;;--;;-~-;-- -6 --;;- 80 
;;-;-,, 


E 
H A F 
0 
L 
R 
W T 
0 
R 
0 
------ 
-- 


~ 
• 
I 
U 
BB 
~ m 
4 
ffl 
~ 
• 
7 
R 
I 
A T 
F 
N L 
E 
0 
R 0 
D 


I A A L N 
27 13 
2 4~ 46 


1'1<.UBE JliJ 


E 0 F S G etc 
51 37 26 23 41 
etc 


m (1) A fomth and possibly the most degant solution to the p10blem of reconstructmg 
the keys fo1 double trnnsposit1on will now b<' p1c<;l'Pted 3 
Rt>fl'rcnce will be made to the two 


matncco; and kl'ys shown m figure 363 
Let the P-)C1 and P~c2 s<'quences resultmg from the 
first and the seC'ond trnnspos1tions, respl'ctivcly, be <;Jiown, as seen b<'low 
1 
2 
Term numbe1 ____ 
01 
02 
03 
04 
06 
06 
01 
08 
09 
10 
11 
12 
ld 
14 
16 
16 
17 
P~C1 sequence __ 
03 
15 27 
JCJ 
51 
05 
17 
29 41 
09 
21 
3J 45 01 
13 25 37 
P~C2 st•quence __ 27 
13 02 43 46 51 
37 26 23 
41 
30 16 20 OJ 
45 36 19 


18 
19 
20 
21 
22 
21 
24 
25 
26 
27 
l8 
29 
30 
31 
32 
33 
14 
49 06 
18 30 42 
12 24 J6 48 02 
14 26 38 50 04 
16 28 
22 05 49 38 35 
.~3 24 
07 
10 15 
01 
48 31 
34 39 25 
14 


d5 
36 
37 
38 
39 
40 
41 
42 
41 
44 
H 
46 
47 
48 
49 
50 
51 
40 07 
19 Jl 43 
11 
23 
,{5 
47 08 
20 32 44 
10 22 34 46 
11 
17 06 50 47 
21 
12 40 44 29 
18 04 08 
OCJ 
42 28 32 
Fir UBB d6k 


3 The baq1c prmr1pl< '! undt rl;i. mg tlu<i Court h and mo .. t important method \\ere d1scovl red and fir.,t presented 


1~34 by Solomon Kullhack, Ph D, thC'n Jun10r Cr;nitanalv.,t, S I S 
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A ca&ual e'1.ammation of thesl' tluel' rows of numhl'is d1'ldosl•s an mte1 estmg tnvanant l<'lat10n- 
slup between any pair of snpcr1mpo&cd numbers m iows 1 and 2 an<l m rows 2 .:ind 3 
F01 


mstancc, take the V<'IY fiNt pair, g~ m 10ws 1 and 2, m Im\rs 2 and 3 till' same pair of supl'i- 


imposC'd numbers will b<' found (umlC'r tl•rm No 14) 
Th1o; sam<' rC'lationslup C'Xists lwhH'l'TI all 


the supenmposed pmrs m rows 1-2 and 2-3 
(2) Given only thl' third row of numb<:'N m ftgur<' 36k, that is, the P~C2 Sl•qut•nce (which 


has hrrl'loforc been designated merely es the P~c srqu<'n<l•), obtamed as a Il''lult of a solution 
bv super1mposmg and anagrammmg several messages, it is not difficult to reconstrm t the second 
10w, the P~c, sequence 
The width of the T-1 matnx can be ascertaml'd by e1thP1 of the two 


ml'thods md1cated m subparagraphs e and f 
It 1s now known to be 12 
A 12-column matrix 
is therl'forl' constructed, contammg 51 cells numbl'rl'd m the normal mann<'r 
This will, of 
course, give the T-1 mah1'1. 'l<'<'ll m figure 363, but without thl' transpo'lihon kry 01 the letters 
m the l ells 
Thus 


J. 
3 
5 
6 
7 
9 
10 
11 
ll 


01 
02 
03 
04 
05 
06 
07 
08 
09 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 29 
30 
31 
32 33 
34 
35 36 
37 38 39 
40 41 
42 43 
44 45 46 
47 48 
49 
50 
51 I 


FIGUBJ: 3'1 


The mvanant 1elat1onsh1p pomted out m roubparagraph (1) above may now be urol'd to estab- 
lish the T-1 key 
Smee the key is known to c.ontam 12 elements, a start may be made With 


any one of 12 possib1ht1es 
Suppose that tht> key hl'gms with 1 
The fiist five terms m the 


P~c, sequl'ncl' would be as indicated hereWith 


1 Term number_ -------- ------- 
_______ 01 


2 
P~c, sequence _____________ ------------ 01 


3 
P~c, sequence __________ ------------ 27 


02 
03 
04 
06 


13 
25 
37 
49 
13 
02 
43 46 


Two "conflicts" 01 contrad1ct10ns arc• at onc.,e mamfestcd g~ m iows 1and2, ~~ m rows 2 and 3, 


02 
13 
al'lo, lJ m rows 1 and 2, 13 m 1ows 2 and J 
The conclusion is obvious that the key numbc1 1 


does not occupy the 1st pos1t1on m the transposition key 
Suppose key number 1 belongs m the 
2d position m the kl'y 
The supenmposed sequences are then as follows 


1 Term number_ 
__ ------------ ---- 
01 
02 
03 
04 
OJ 


2 P~C1 sequence____ _ ___ ------------- 02 
14 
26 
38 50 


3 
P~C2 sequence_______ 
_ _ __ _ _ 27 
13 
02 
43 
46 


01 
26 
02 
02 
Ht•re agam two confhcts are noted 02 m rows 1 and 2, 02 m IOW'l 2 and J, 14 m 10ws l nnd 2, 27 
m rows 2 and 3 
Only a smgle contrad1ction 1s suffiment to permit of discardmg an hypothesis 


The key number 1 docs not occupy the 2d position m the k<'Y 
A tnal 1s madl' of the 3d pos1t1on 
for by numbl'r 1 
Thl' rl'sult-. nrn as follows 


1 Term number_ 
__ 
_ _______________ 01 


2 
P~c 
1 sequence ____________________ 03 


3 P~C2 sequenC'l'_ 
___ 
-------------- 27 


o.z 
03 
04 
05 


15 27 
39 
51 
13 
02 43 46 
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1-I<'t<' tlwrn 1ue no contradictions and 01w c,heck 01 c01roborat10n ~~ m 1ows 1 and 2, ~~ m lOW"I 
2 and 1 
If kC'y numbe1 1 H'11lly occuprnb the 3d pos1t1011 m the key, then the superimpo<i1t1on 


data g1vPn m thP ln<:t "ll't of 10\\S of superunpo<iPd numb<'Ib mav be <'mployed, by transfl'lrmg the 
data to the propm pos1t1on'3 111 tlw skl'letomzed figure 36m(l) 
1 Term number ______ 
Ql 
02 
03 
04 
os 
06 
01 
08 
09 
10 
11 
12 
13 
a 
u; 
16 
11 
2 P-c, <iequenC'(' ____ 03 
15 27 J9 51 
05 
01 
3 P-C2 seqtlC'nce ___ 27 
13 
02 43 46 
51 
37 26 23 
41 
30 
16 20 03 
45 36 
1 I} 


18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
29 
30 
31 
32 
33 
34 


02 
04 
22 05 49 38 35 J3 24 07 
10 15 01 
48 Jl 34 39 25 14 


35 
d6 
37 
38 
39 
40 
41 
42 
43 
44 
45 
46 
47 
48 
49 
50 
51 


11 
17 06 50 47 21 
12 40 44 2q 
18 04 08 09 42 28 
32 


FIGURE 36m (1) 


It tlwn b1•wm<'s at once pos&1blc, by 1pfer1111g to tlw T-1 matux-, to msC'1t m01P numhP1s m tllC' 
P-C1 sequen<'C' 
Thus 
1 Te1m number______ 
01 
02 
oa 
04 
05 
06 
01 
08 
09 
10 
11 
12 
rn 
14 
u 
16 
17 
2 P-C1 sequence ___ 03 
15 27 39 51 
05 
17 29 41 
01 
13 25 37 
3 P-C2 sequence__ 
27 
13 02 43 46 
51 
37 26 23 41 
30 16 20 03 45 36 19 


18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
29 
30 
31 
32 
33 
84 
02 
14 26 38 50 04 16 28 
15 01 
48 31 
34 39 25 
14 
49 
22 05 49 38 35 33 24 07 
10 


35 
36 
37 
38 
39 
40 
41 
42 
4d 
44 
45 
46 
47 
48 
49 
60 
61 
40 
11 
17 06 50 47 21 
12 40 44 29 
18 04 08 09 42 28 32 


FIC'URll: 36m (2) 


07 
The new placC'mPnt., no" penmt of placmg numl>l'r'> m the P-C, sequenu' 
For e:ii.ample, 17 
m rows 1 and 2 pPrm1t of placmg th!' m1mbt'r 07 above the numbeI 17 m the P-C2 sequence, gg 


m rows 1 and 2 permit of placmg the numbC'r 08 above the number 29 m the P-C2 Sl'quence, 


and so on 
In only .t few mome11ts till' entne P-C1 st'qul'nce can be established 
Thus 


1 Term number 
___ 
01 
02 
o3 
04 
05 
oo 
01 
08 
09 
10 
u 
12 
13 
u 
1& 
16 
11 
2 P-c1 sequence ____ 03 
15 27 39 
51 
05 
17 29 41 
09 21 
33 45 01 
13 25 37 
3 P~c2 sequPnC'e ____ 27 
13 02 43 46 
51 
37 26 2J 41 
30 16 20 03 45 36 
19 


18 
19 
20 
21 
22 
23 
24 
.l~ 
26 
27 
211 
29 
30 
31 
32 
33 
34 


49 06 
18 30 42 
12 24 36 48 02 
14 26 38 50 04 
16 28 
22 05 49 38 35 33 24 07 
10 15 01 
48 31 
34 
31} 
25 14 


36 
36 
37 
38 
19 
40 
41 
42 
48 
44 
46 
46 
47 
48 
49 
60 
61 
40 07 
19 31 
41 
11 
23 
35 47 08 20 32 44 
10 22 34 46 
11 
17 06 
50 47 21 
12 40 44 
2Q 
18 04 08 
01} 
42 28 32 


FIGURE 86" 


(3) The d.etermmat10n of thP T-1 krv 1s now a Hry s1mple mattPr 
Rmce it is known that 
the key has 12 numb<'rs, it I'> only ne<'e<1<:1uv to note m the P-C, sequen<'t' thr relntne order of 
the numbers 1 to 12 
It 1q a<i iollowq 


1 
2 
1 
4 
~ 
6 
7 
R 
9 
10 
11 
12 


3 
'l 
Q 
1 
fi 
12 
2 
4 
7 
11 
8 
IO 


71 


Tlus is mer<'ly the mvnbe of the actual kPy, the lattl'r may be obt.un<'d by mvm.,1011 
Thus 


1 
2 
1 
4 
5 
6 
7 
II 
9 
10 
11 
12 
4 
7 
1 8 
2 
5 9 
11 
J 
12 
10 6 


C'ompnn=1on of tlns key with tlie T-1 key shown m figure 16J will estnbhsh tlw id.en t1 ty of t hP t \\ o 
The det<'rmmat10n of the T-2 key is obv10u'>, havmg the T-1 nt hand 
In tlus <ase both matrt<'<'S 


and keys an• 1dent1C'al 


n A ttC'ntion will be du eded to a further mterestmg phPnomcnon m tlll'; c nsP 
RPf Prt mg to 
figme 36n, if ch.tms of eqmvalrnt<i are con<itrudl'd hPtwPen <'lC'ment<i of the l<it and 1d iows only, 
th<' following two chams are obt1uned 


01 27 15 45 18 22 35 11 30 31 34 14 03 02 13 20 49 42 40 21 38 50 28 
04 43 44 29 48 09 23 33 25 07 37 06 51 32 39 47 08 26 10 41 12 16 36 17 19 05 46 


FIGURE 36o 


All the terms of the P-C2 sequence are reprPsented, e:ll.cept the number 24, "luch stands by 
itself If now e11ch of thPse <'hams is shd agam'>t 1tsPlf, \\hen prnperly JUxtapo<ied, thl' super- 
unposed pairs are 1dPnt1cal with those m rows 1 and 2 m figure J611 
NotC' the follo\\mg 


(l){Ol 27 15 45 18 22 35 11 JO 31 34 14 03 02 13 20 49 42 40 21 38 50 28 


03 02 13 20 49 42 40 21 38 50 28 01 27 15 45 18 22 35 11 30 31 34 14 


(2){04 4J 44 29 48 09 23 33 25 07 37 06 51 32 39 47 08 26 10 41 12 16 36 17 19 05 46 
39 47 08 26 10 41 12 16 36 17 19 05 46 04 43 44 29 48 09 23 33 25 07 37 06 51 32 


FIGURE 36p 


The apphcat1on of the foregomg phenomena m the cose uuder sturly is ob\'1ous 
Here it is not 
even nec,essary to ascrrtam the width of the T-1 matrix before proceedmg to try to establish 
the T-1 key 
Of C'Oursc•, the numbPr of chams winch may be l'Stabhsbl'd \\Ill vary with the 


6 
2 
7 
6 
3 
8 
4 


01 02 03 04 05 06 07 08 
09 10 11 12 13 14 15 16 
17 18 19 20 21 22 23 24 
23 26 27 28 29 30 31 32 
33 34 35 36 37 38 39 4l' 
41 42 43 44 45 46 47 48 
49 50 51 I 


A (=T-1) 


3 
9 
7421181065 


01 02 03 04 05 06 07 08 01} 10 11 
12 13 14 15 16 17 18 19 20 21 22 
23 24 25 26 27 28 29 30 31 32 33 
34 35 36 37 38 39 40 41 42 43 44 
45 46 47 48 49 50 51 I 


B 


3 
g 
74 211810611 


04 12 20 28 36 44 02 10 18 26 34 
42 50 06 14 22 30 38 46 08 16 24 
32 40 48 05 13 21 29 37 45 01 09 
17 25 33 41 49 03 11 19 27 35 43 
51 07 15 23 31 39 47 I 


C (=T-2) 


F!GUBll: 170 
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-.pecific matrices and l ... Pyb, hut the ge1wral p11nc1ples herem prC'sented mnv m•verthekss be• 
apphe•d 
In some c,1sec; 1t may bC' IlC'l'<''l'lflry to JH"Xtnpose• t'\\o ddfC'r('Jlt chnms ohtamPd by 


Pquatmg tP1mc; frnm row<1 1 nnd 3, rath<'r th.m 111xtaposmg on<' cham agamst 1tsl•lf 
OnlJ a 


fC'w mmutC's expC'lllll<'ntatmn will be necessary to PSt.thhc;h C'ontrad1ct10ns which will permit of 
chscurdmg f.tll.tc10us hypotlH '-<'b 


o (1) In tlw foH•gomg P"-plnn,1t1011, tlw t\\ o t1 ,111..,po..,1tion kcyc; .md matricl's were identical 
Ev<'n '\\hl'n tlwy fill' d1ftC'rc•nt the• same prmc1ples, '\\1th mmor mod1ficut10ns, may be applwd 
The matrices and kPy.., of figure 37a w11l agam b<' Pmployed to dPmonstrntP the m•cessa1y mod1- 
f1cat1ons 


(2) Fu..,t, prtpaH tlH' t'\\O mnt11cP.., '\\1th rnn..,l'<HbH• munbers m the cells of both matricPs, 
..is sho'\\n at A nnd B m figun• 370 and tlwn pri>paie thP T-2 matrix <1ho\\n ut C 


(3) Wntc the P-7C'1 c;pquemC' for T-1, undPr it '\\-llt<' the P-7C 1 for T-2, und unde1 


tlH' lntter \Hit<' the P-7C2 <1c•quP11C'l' for the finul uyptogrnm 
Tlmc; 


1 Tl•un numh<'I 
_ __ 
__ __ 
___ 
01 
02 
04 
04 
o~ 
06 
o; 
os 
ou 
10 
11 
u 
13 
a 


2 P-7C1 1>equencc fo1 T-1 __ __ 
04 
12 
20 28 
36 
44 
02 
10 
18 
26 
34 
42 
50 
06 
3 P-7C1 spquencP for T-2_ 
o~ 14 
25 
36 
47 
06 
17 
28 
39 
50 
01 
12 
23 
34 
4 P-7C2 sequp11ee - 
20 
06 
48 
3.~ 
Hi 
44 
30 
21 
03 
39 
04 
42 
32 
17 


I~ 
16 
17 
18 
19 
.10 
21 
.12 
23 
24 
25 
26 
27 
28 


14 
22 
30 38 
46 
08 


45 
05 
16 
27 
38 
49 
51 
36 
22 
13 
49 
31 


16 
24 
32 
40 48 05 
13 
21 
11 
22 
33 
44 
10 
21 
32 
43 
34 
24 
09 
43 
26 
16 01 
35 


20 
30 
31 
32 
33 
J4 
3o 
36 
37 
29 
37 
45 01 
09 
17 
25 
33 
41 


04 
15 
26 
37 
48 
08 
19 
30 41 


28 
14 
05 
41 
23 
10 
46 
37 
19 


4o 
44 
45 
4t1 
47 
48 
49 
JO 
51 
35 
43 
51 
07 
15 
23 
31 
39 
47 


09 
20 
31 
42 
07 
18 
29 
40 51 
18 
08 
45 
27 
02 
38 
29 
11 
47 


FIGVRE d7p 


38 
39 
40 
u 
42 
49 03 
11 
19 
27 


02 
13 
24 
35 4b 


12 
JO 
40 25 07 


Nott•, now, th<' mvarrnnt rdat10nsh1p h<'t'\\N'n ro'\\s 1-2 and 3-4 
Tht• s.i.me phPnomenon ic; 
herP mnmfoskd ac; '\\ ns Pnwuntcr< d m th<' prcPedmg cnsE' wher<' the T-1 and T-2 matrices and 
keys werC' identical 
It follo\\'s, tl•C'rl'for<', thnt the prmr1ph•s l'hil'1dnted undE'r subparagraph m 
may be applied, \\'1th some mod1ficat10ns, .i.lso to the cac;c where d1ff PrPnt kl'ys and matricPs nn• 
Pmployed tor double transposition 
The '\\idth of the T-1 matu\. mav bC' aseertamed m the 
mnnnl'r nhPndy n.dicatc•d, an nc;sumpt1on 1<1 much• ur,: to thC' pos1t1on occnpiC'd by key number 1 
of the T-1 key, tlus nssumption p10v1dl's datn fo1 mal...mg nu nc;sumpt1011 ns to the, \\'Jdth of tll<' 
T-2 mut11~ 
'\Vhm the corrc'ct p ur of nssmnpt1onc: is m.1d<', th<• data m ro\\'s I nnd 2 arc ror- 


roboratf'cl by thosl' m ro'\\s 3 and 4 
From that pmnt on the rest is easy Ami follo\\S along thP 


same Imes as b<'f ore> 


p (1) The proct>dun• will be illustrated by employmg the P-7C sl•quence m figure 376 
(which is tll<' samE' as thnt labelled P-702 c;c•quenre m figure 37p), it bPmg assumed that nothmg 
is known about the matm l's, nnd th 1t the <1equence was obtam<'d from .t c;olution by superim- 
posmg and rmngr.unmmg St'" c•rnl ID<'S"IRJH'"> of 1df'I1 hl'nl l<'ng th 


I 
l - 


7i3 


(2) Th<' width of the T-1matux1s i>stabhshccl fl'> 8 and tlH' T-1 mutw .. ">Pt do\\<n 


2 
3 
4 
b 


01 
02 
03 
04 
05 
06 
07 
08 
09 
IO 
11 
12 
lJ 14 
1.3 
16 
17 
18 
}C) 
20 
21 
22 
23 
24 
25 
26 
27 
28 
29 
30 
31 
32 
33 
34 
35 
36 
37 
.38 
39 40 


41 
42 43 
44 
45 46 47 48 
49 50 
51 I 


T-1 


F!C.VR~ 17q 


(J) Assunung that key numbt•r 1 occupll'b the fiNt pos1t1011 m tht• T-1 ].,.py, tlw numbers are 


mserted m row 2, iepresentmg the h<'gmnmg of the• P->C'1 sequenu• f01 T-1 
Th<' supenmposed 
pairs m rows I and 2 nr<' d1c;tnbute•<l m ro'\\s 3 ancl 4, '\\Ith the ii>sults shown m figure 37r(l) 


1 T<'rm number_ 
-------- - - - 
01 
02 
03 
04 
05 
06 
07 
Ob 
09 
10 
11 
12 
13 
14 


2 P~c 1 sequence for T-1 ------ 01 
09 
17 
25 
33 
41 
49 


3 
P~c 1 sequence for T-2 ______ 
05 
03 


4 P-7C1 seqm.•nc<' _ --------- 
20 06 
48 
33 
15 
44 
30 
21 
03 
39 
04 
42 
32 
17 


15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
2~ 
26 
27 
28 


07 
02 
01 


51 
3b 
22 
13 
49 
JI 
.34 
24 
{)<) 
43 
2b 
16 01 
35 


29 
30 
31 
32 
13 
34 
3~ 
16 
3i 
31- 
d9 
40 
41 
42 


Ob 
04 


28 
14 
05 
41 
23 
10 
4b 
37 
19 
12 
50 40 25 
07 


4d 
44 
H 
46 
47 
48 
49 
50 
51 


18 
08 
45 
27 
02 
38 
29 
11 
47 


FICVRE l7r (1) 


(4) An attempt is no\\ made to construe t 11 T-2 matri:x wluch '\\Ill produce the distribution 


and spat mg of the numbeis m row 3 
For nampl<', from the position of the numb<'r 05 the matrix 


would have to b<' of such dimenswns that thne ttH' short columns of 2 JettPI"> and long columns of 
3 letters, or short columns of 3 h•tters nnd Jong columns of 4 l<'tte1s 
The forme1 hvpothes1s 
cau b<' discarded at onre, for the mkrvalb bPtWPl'n the numhPIS 03, 07, 02, 01, and 06 m row 3 
make it untenable 
The latter hypoth<'s1s may also be discarded, tor the mte1 vals bPtwcen 03 


and 07 and between 01 nnd 06 make 1t impossible 
HPnce k<'Y nuwb<'I 1 cannot occupy tlw fnbt 


position m thP T-1 k<'y 
Position 2 is 11<,sumPd fo1 k<•y numh<'r 1 and the procedure r<•peated, 


also \\'ithout good Il'blllts 
Note '\\hclt happens '\\lll'n pob1tlon 4 1s •1<1sumcd for kc•y number 1 m 


the T-1 key 
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1 Term numbl•L_ _ _______________ 
01 
02 
03 
04 
05 
06 
07 
08 
09 
10 
11 
12 
13 
14 
2 P~C1 '3equence for T-L_______ 04 
12 
20 28 36 44 
3 
P~C2 sequenre for T-2 _____ 03 
06 
01 
4 
P~C:.i sequence_______ 
_ _____ 20 
06 48 
33 
15 44 
30 
21 
03 
39 04 42 
32 
17 


15 
16 
17 
18 
19 
20 
ll 
2J 
l3 
24 
J5 
26 
27 
28 


05 


51 
Jb 22 lJ 49 Jl J4 24 
09 
4J 2b 
lb 01 
J5 


29 
30 
31 
32 
33 
34 
35 
36 
37 
38 
69 
40 
41 
42 


04 
02 


28 
14 
05 41 
23 
10 46 
37 
19 
12 50 40 25 07 


43 
44 
45 
46 
47 
48 
411 
50 
51 


18 08 45 27 
02 
38 
29 
11 
47 


FIGURB 37r (2) 


(5) Heu• there are found no contrad1ct10ns of the nature of those pomted out above 
The 
T-2 matrn: appea1s to have columns of 4 and 5 letters, smce the mterval between 04 and 02 m 
row .3 can uc,wmmodate a bhort column of 4 and a long column of 5 letters, the mtcrval between 
0.5 and 04 lJ.Il auommodc1t<' 2 bhort columns of 4 letters and l long column of 5, the mtervals 
between OJ and 06, 06 and 01, 01, and 05 ran n.rwmmodate long columns of 5 letters each 
Only 2 matr1cps rnn lw rnnst1 urted of 51 lettrrs with long rolumn., of 5 and shm t rolumns of 
4 letters 
'I'hcy arc 


Key of 11 
{ 
7 (long) X5=35 
---- -- 4 (short)X4=16 51 


r 
{J (long) X5= 15 
Key of 12- - 
--- - 9 (short) X 4=36 51 


Each of these T-2 matrices ts lei.ted as a posSllnhty 


23 456 7891011 


01 02 03 04 05 06 07 08 09 10 11 
12 13 14 15 16 17 18 19 10 21 22 
2J 24 25 26 27 28 29 30 31 32 33 
34 35 Jb 37 38 J9 40 41 42 43 44 
45 46 47 48 49 50 51 I 


A 


2 
3 
4 
5 
6 
7 
8 
19 
10 
11 
12 


01 02 03 04 05 06 07 08 09 10 11 12 
13 14 15 16 17 18 19 20 21 22 23 24 
25 26 27 28 29 30 31 32 33 34 35 36 
37 38 39 40 41 42 43 44 45 46 47 48 
49 50 51 I 


B 


FIGURE 37r (3) 


(6) If matrix A is cont>< t, then the numbers ill columns 3, 6, 1, 5, 4, and 2 <'8Jl be transferred 
to row 3 m figme 37r (2), these will permit of msertmg numbl'rs m 10w 2 
No contradwt1on., 
and many d1erks aIP found 
HPrL 1s the diagram 
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1 Te1m number_____________ ________ 
01 
02 
Od 
04 
05 
06 
07 
08 
011 
10 
11 
12 
13 
14 
2 P~c1 sequence for T-L_ ----- 04 
12 
20 28 36 44 
42 50 


3 
P~c1 sequence for T-2 ________ 03 
14 
25 36 47 
06 
17 
28 39 
50 
01 
12 
23 
34 
4 
P~C 
1 sequence _________________ 20 06 48 33 
15 44 
30 
21 
03 
39 04 42 
32 
17 


16 
lb 
17 
18 
19 
20 
21 
ll 
26 
24 
2\ 
26 
J7 
28 
14 
22 
JO 
J2 
40 
05 
lJ 21 


45 
05 
lb 27 J8 
·HI 


51 
36 
22 
13 
49 Jl 34 
24 
0<) 
43 2h 
lb 01 
35 


29 
60 
61 
32 
33 
34 
35 
36 
37 
38 
d9 
40 
41 
42 


17 
25 
41 
49 
03 
04 
15 
26 
37 48 
02 
13 
24 
35 46 
28 
14 
05 
41 
23 
10 4b 
37 
19 
12 
50 40 25 
07 


43 
44 
45 
46 
47 
48 
49 
50 
51 
51 
07 
23 
31 
39 


18 08 45 
27 
02 
38 2q 
11 
47 


FiGVRE 37r (4) 


(7) In the fiI.,t, place note, m row 2, the constant d1ftercnce 8, g1nng many corroborations 
that the w1dth of the T-1 matnx is 8, m the second place no confhrtb whateve1 bewme memfest 
bC'tween the pairs of rows 
Thus, the vahd1ty of thi:i assumption of a T-2 mat1n: with 11 columns 


is well established 
The rnst follows qmte readily, with thP fiirnl rec;;ult that figure 37r becomes 
wmpleted, and the recovery of both kpys is a •mnple matter 
In foc,t, both keys may be estab- 


lished from a simple study of rows 2 and 3 of the final figme (wlnd1 would, of rnmse, be i<lentu,al 
with that shown m fig 37p and need not he1e be repeated) 
q A careful study and good gia.sp of the prmc,1pleb and methods Plumdated m tills paragraph 


will be suffiment to md10ate to the student that when, a& a it>sult of o. close study of several 
messages m the same keys, partial c~P sequences become availc1ble, thl entire c~p sequence 
or sequences can u&ually be rewnco;tructed from the partial sequence or sequences and the mes- 
sages solved without too much d1fuculty 
For mbtance, bUppose it has developed that the 
enemy has become addicted to stereotyp10 begmmngs, so that the fiist few letters of a message 
or of several messages c.an be rewnstrurted with some assurance of certainty 
The construction 
of pu.rtial c~P bequenceb an<l then completion by means of the prmciples set forth, espemally 
those presented m subpara.graphs m-p, may 1esult m reconstruction of the complete Q---,.p 
sequences and ultimate recovery of the hansposit10n key or keys 
28 Special cases of solution of double transposition ciphers -a When the double trans- 


pos1t10n system is employed m the held and is used for a volummous traffic it is almost mev1table 
that cci tam situations will arise which make po&s1ble a rather easy &olut10n 
Aside from the case 
m whirh several cryptograms of identical length an<l m the same key are mterc,epted, other cases 
of a sper1al nature may arise 
Some of these will be discussed m this paragraph 
b First, there is the case m which an mexpeuenced cryptographic clerk fails to execute the 
double transpos1t1on properly and causes the transnuss10n of a myptogram which is only a smgle 
transposition 
The solution of tlus message will be a s1D1ple matter and will, of course, yield the 
key 
If the key is the same for both t1anspoc;;1tions it ico; obHouc;; that thls will pe1m1t the ieadmg 


of all othe1 messages even though the latte1 lune been cou ertly c,ryptogiaphed 
The only 


difficult part of the matter is to find among a large number of mtcrcepted myptograms one which 
mvolves a. blunder of thls sm t 
When the cryptanalyst has, as a iesult of considerable expen- 
ence, become a.dept m the solution of tra.nspos1t1on mphe1s the \\01k of testmg cryptograms to 
a.scertam whether 01 not they mvolve smgle columna1 tianspos1t10n is not difficult and goes quite 
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iapidly 
F01 only a few nunutes 11.10 sufucient to give him the" feelmg" that the c,ryptog1a.m is 01 


1~ not solvable by smgle transposition 
He rmght not be able to pomt out any specific mdication~ 
which give him this feehng if asked to do so, ncve1theless it must be recogmzed that his mtmtion 
is alone sufficient to tC'll lum when thC're is hope of solution along tlus lme and when further wo1k 
upon the hypothesis of smgle trnnsposit10n is useless 


c (I) Next comes the case m which the enmphermg iectanglcs of a double transposit10n 


myptogram happen to be perfect squares (that is, both T-1 and T-2 rectangles arc perfect 
squares) 
In this case, not only is such a cryptogram detectable at once, smce the total number of 


lctt<'rs is till' squaH• of tl)(' numbei of elements m the key, but also the cryptogrnm can be solved 
ma ve1y ... unple manner 
For the cryptogram now represent~ a case m which a completely-filled 


rectangle has been employed, and moreover there is no need even to assume various widths 
(2) Given the followmg myptogram of 49 letters (7X7) as an example, the te'tt is tran- 


scribed as shown m figme 39a and 1etranseribed as m figure 39b 


Cryptogram _ 


1234~6 
U S R U 0 R E 
C H G W E F E 
T I A D R E M 
RESDDNN 
N T 0 N N C N 
0 0 E 0 D 0 V 
E L D E I E E 


FIGURE 39a 


U CTR N 
N 0 E 0 E 


0 E S H I 
R D N D I 
ET 0 LR 
R F E N C 


1234567 
U C T R N 0 E 
S H I E T 0 L 
R G A S 0 E D 
UWDDNOE 
0 E R D N D I 
R F E N C 0 E 
EEMNNVE 


FIGURE 39h 


2615374 
C 0 U N T E R 
H 0 S T I L E 
G E R 0 A D S 
W 0 U N D E D 
E D 0 N R I D 
F 0 R C E E N 
EVENMEN 


FIGURE 39r 


G A S 0 E 
0 E E E M 


DU W DD 
N NV E 


2 
6 
1 
5 
3 
7 
4 


H 0 S T I L E 
F 0 R C E E N 
COUNTER 
E D 0 N R I D 
GEROADS 
EVENMEN 
W 0 U N D E D 


FIGURF 3911 


(3) The column~ of figure 39b are now anagiammed, as m figure 39c, and the rows rearranged, 
as m figure 39d 
d When the enciphm mg redangle is not a perfect square but nevertheless a complete rec- 
tangle, solution of a smgle cryptogram becomes somewhat more difficult Here the columns are 
all equal m length, smce the last row of the rectangle is completely filled 
Two cases will be 


consid£'red, fast, when the width of thl' rectangle is a multiple of the depth, or number of letters 
m the column~, and sl'cond, when the depth IS a multiple of the width 
e (1) Takmg up the first case, note the followmg enc1pherment 


6 
2 
10 
1 
7 
4 
9 
8 
3 
5 
6 2101749 8 
3 
5 


w H 
E 
N w I 
L 
L 
F 
I 
N s 
A 
I 
T 
H s 
R 
N 
G 
1 
2 
3 
4 
5 
b 
7 
8 
9 
10 
4 
14 
24 
14 
44 
2 
12 
22 
32 
42 


- 
-- - 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
R SIT s 
Q u 
A 
D 
R 
0 


11 ~~ 


14 
15 
16 
17 
18 
19 
20 
F 
R 
L 
0 s 
I 
u 
H 
L 
D 
9 
19 
29 
39 
49 
6 
16 
26 
36 
46 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
N 
R 
E 
A c 
H 
G 
0 
L 
D 
I 
0 
D 
N 
E w R 
N 
E 
I 
21 
22 
23 
24 
25 
26 
'r1 
28 
29 
30 
10 
20 
30 
40 
50 
1 
11 
21 
31 
41 


-- -- ---- - 
-- - 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
E 
N v 
I 
L 
L 
E 
T 
0 
N 
w Q c 
L 
A 
L 
D 
0 
T 
I 


di 
d2 
JJ 
d4 
35 
3b 
37 
38 
39 
40 
5 
16 
25 
35 
~ 
8 
18 
28 
38 
48 


1-- - 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
I 
G 
H 
T 
A 
D v 
I 
s 
E 
L 
A 
G 
E v 
E 
T 
E v 
H 


41 
42 
4d 
44 
45 
4b 
47 
48 
49 
llO 
7 
17 
27 
37 
47 " 


13 
~ 
33 
43 


'I -1 Rectangle 
T-2 Rectangle 
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P~C sequence______ 34 39 40 3a 37 H 1e 20 1o 11 32 36 31 d8 aa 
2 e 
1 
8 
3 '2 46 n 48 43 


Cryptogram_________ I 0 N L E S R 0 Q A N L E T V H I W L E G D I I H 


4 
9 10 5 
7 44 @ 00 ~ ~ ~ 26 ~ 28 ~ U IB 11 
~ ~ ~ 29 00 ~ 'r1 


N F I W L T S E A V R H N 0 E S U R D T A L D C G 


If the P~C sequence is exammed it will be found that sections thereof fall mto two cate- 
gories, as follows 
Section 
Section 
r- 
4 


9 10 
5 
7 
r- 
2 


6 
1 
8 
3 
2 - 
14 
19 
20 
15 
17 
7 - 
12 
16 
11 
18 
13 


Category A_____ 
3 - 
24 
29 30 25 
27 
Category B____ 
8 - 
22 
26 
21 
28 23 
4 - 
34 39 40 
35 37 
9 - 
32 36 
31 
38 33 
5 - 
44 49 
50 45 47 
10 - 
42 46 
41 
48 43 


(2) There is obviously a defimte regularity m the composition of the sections whereby, if the 
letters correspondmg to the numbers m one section can be assembled properly, all the letters 
corrcspondmg to the numbers m the other sections belongmg to the same category (A or B, 
respectively) will be assembled correctly too 
For example, m category B the letters correspond• 
mg to the numbers occupymg the third, first, and fifth positions m each section are sequent m 
the plam-text rectangle, m category A the letters correspondmg to the numbers occupymg the 
first and fourth positions m each section are sequent 
Moreover, all the letters m ea.ch section 
come from the same row m the T-1 rectangle 
Consequently, if two sections commg from the 
same row can be identlli.ed, there will be 10 letters which may be rearranged by experunent to 
form plam text, and the key for this rearrangement will apply to all other pairs of sections 
For example, the message m this case has a Q and only one U 
The Q (P~ sequence No 
15) ism the second section, the U (P~C sequence No 16) IS m the seventh section 
These two 
sections come from the same row and the letters may be anagrammed ' 


I 
2 
3 
4 
5 
6 
7 
8 
9 10 
S R 0 Q A 
and 
S U R D T 


2 
1 
6 
8 
or or 
or 
or 
86101475Q23 
R S T S Q U A D R 0 


Experiment may now be made with two other sections, applymg the same transposition 
Thus 


1 
2 
3 
4 
5 
I 0 N L E 
and 


678910 
N L E T V 


2 
I 
6 
8 
or or 
or 
or 
8 
~ 10 
1 
4 
7 
5 
9 
2 
3 


0 I 
N 
E 
E N V I L L E T 0 N 


Obviously the proper key for rearrangement is 8-6-10-1-4-7-5-9-2-3 
By contmumg this 


procedure the followmg addit1onal 1ows of the T-1 rectangle are reconstructed 


I 
2 
3 
4 
5 


N F I W L 
TSE AV 
AL DC G 


and 
and 
and 


678910 
H I W L E 
G D I I H 
RH N 0 E 


8 
6 
10 
1 
4 
yields ______ w H E N W 


yields ______ ! G H T A 


yields ______ N R E A C 


I L L F I 


D VISE 
H G 0 L D 


• The fa.ct that the length of the sectwns cmresponds to 5-letter groups has, of course, no bea.rmg on the 
va.hd1ty of the method 
In this case it Just happens that the rectangle contams 5 letters per column 


824155-41-8 


11 
I 


78 


The various rows are now assembled m sE"quence, givmg the followmg 
W H E N W I L L F I 
RSTSQUADRO 
N R E A C H G 0 L D 
E N V I L L E T 0 N 
I G H T A D V I S E 


The transposition key can now be reconstructed with ease 
(3) The cryptanalyst m this case must, d course, make nn assumption as to the width of 
the enciphermg rectangle before he can apply the method 
With a number suc,h as 50, the 


dlIDensions 10X5 or 5X10 suggest themselves 
The prowss of findmg cipher groups which 


form pairs on the same row is one of "cut and try " If there is a smgle Q and a smgle Um the 
message, the initial pair of groups is obvious 


f When the dE'pth of the rectangle is a multiplE' of the width, solution follows along the 
Imes of thE' precedmg case 
Takmg the samE' message as before, note what happens m enci- 


pherment with a rectangle of 5 columns contammg 10 letters each 
2 
51 43 
25 143 


1 
2 
3 
4 
5 
3 
8 
13 
18 
23 
w H 
E 
N w 
E 
L 
T 
D 
E 
------ 
- 
------ 
6 
7 
8 
9 
10 
28 
33 
38 
43 
48 


I 
L 
L 
F 
I 
0 
v 
T 
H 
I 
- 
------- 
IT 


- 
-- 
11 
12 
13 
14 
15 
1 
11 
16 
21 
R s 
T s 
Q 
w 
R u 
N 
- 
-------- 
- 
--- 
-- 
16 
17 
18 
19 
ID 
26 
31 
'l6 
41 
46 


u 
A 
D 
R 
0 
H 
E 
L 
I 
D 
------ 
------ 
21 
22 
23 
24 
25 
5 
10 
15 
ID 
25 


N 
R 
E 
A c 
w I 
Q 
0 c 
------ 
------ 
26 
27 
28 
2D 
30 
30 
35 
40 
45 
(JO 


H 
G 
0 
L 
D 
D 
L 
N 
A 
E 
------ 
------ 
31 
32 
33 
34 
,~ 
4 
9 
14 
19 
24 


E 
N v 
I 
L 
N 
F s 
R 
A 
-------- 
------ 
36 
37 
38 
39 
40 
2D 
34 
39 
44 
49 
L 
E 
T 
0 
N 
L 
I 
0 
T s 
------- 
------ 
41 
42 
43 
44 
45 
2 
7 
12 
17 
22 
I 
G 
H 
T 
A 
H 
L s 
A 
R 
------ 
- 
---- 
46 
47 
48 
49 
'ill 
27 
32 
37 
42 
47 
D v 
I 
s 
E 
G 
N 
E 
G v 


T-1 
T-2 


P--+C sequence ___ 13 as 11 36 15 40 u 39 12 37 
3 
28 
1 265304292 27 23 48 2146 25 
(JO 24 49 2247 
Cryptogram _____ T T R L Q N S 0 S E E 0 W H W D N L H G E I N D C E A S R V 


~ 43 U il ID 45 
~ 44 U 42 8 33 6 M W ~ 934732 


D H U I 0 A R T A G L V I E I L F I L N 


Takmg the numbe1s of the P-+C sequence and ariangmg them m sections of 10, the results 
are as follows 


. 
' 
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1 
2 
3 
4 
5 
6 
7 
8 
9 
10 


3 
28 
1 
26 
5 
30 
4 
29 
2 
27 
8 
33 
6 
31 
10 
35 
9 
34 
7 
32 
13 
38 
11 
36 
15 
40 
14 
39 
12 
37 
18 
43 
16 
41 
20 
45 
19 
44 
17 
42 


23 
48 
21 
46 
25 
50 
24 
49 
22 
47 
It is obvious that if the 3d, 9th, 1st, 7th, and 5th columns are made ~equent, good text will be 
produced w1thm the 5 rows 
Thus 


12345678910 
T T R L Q N S 0 S E 
EOWHWDNLHG 
E I N D C E A S R V 
D H U I 0 A R T A G 
L V I E I L F I L N 


3 9 1 7 5 
R S T S Q 
WHEN W 
N RE AC 
U AD R 0 
I L L F I 


The subsequent steps are obvious 
Here agam m solvmg an unknown example it would be 
necessary to test out various assumptions with respect to the dIIDens1ons of the rectangle before 
attemptmg to apply the method outlmed 
g Whenever this srmple relat10nsh1p between the width and depth of the rectangle obtams, 
that is, when one d1mens1on is a multiple of the other, solution of a smgle cryptogram is relatively 
easy The reason for this is not hard to see 
When the enciphermg rectangle is a perfect square, 
every column of the T-2 rectangle is composed of letters which all come from the same row of 
the T-1 rectangle Hence solut10n ism this case the same as though a false double transpos1t1on 
were m effect, with merely the columns and the rows of a smgle rectangle shifted about When the 
width of the transposition rectangle is twice the depth, a column of the T-2 rectangle contams 
half the letters appearmg on one row of the T-1 rectangle, two columns therefore contam all the 
letters belongmg m the same row of the T-1 rectangle If the width were three tlIDes the depth, 
then three columns of the T-2 rectangle would conte.m all the letters belongmg m the same row 
of the T-1 rectangle, and so on When the width is half the depth, a column of the T-2 rectangle 
conte.ms all the letters e.ppee.rmg m two rows of the T-1 rectangle, when the width 18 one-third 
the depth, a column of the T-2 rectangle conte.ms all the letters e.ppearmg m three rows of the 
T-1 rE"ctangle, and so on But when this multiple relationship no longer obte.ms, solution becomes 
more dlllicult because each column of the T-2 rectangle is c,omposed of letters coming from sev- 
eral columns of the T-1 rectangle, man irregular d1Str1bution 
Solution is, of course, most dllli- 


cult when mcompletely filled rectangles are used 
However, although solvable, even m the case 
of a smgle message, the solution will not be dE"alt with m this text 


I. 
I: 


I 
I: 


I 
'I 


SECTION VI 


PRINCIPLES OF MATRIX RECONSTRUCTION 


Special designs or geonlt,tric figures_ 
_ __ 


Reconstruction of transposition matrix 


Paragraph 
-- --- 
29 
- -- --- 
30 


29 Special designs or geometric figures -a It is impo..,'l1ble here to elucidate and demon- 
strate by example all the methods which may be ui.ed for the solution of cryptograms produced 
by the many various types of transpos1t1on dei.1gns or geometuc figures other than the srmple 
rectangular ones thus far treated 
Reference may bP made to such matrices as triangles, trape- 


zoids, and polygons of various symmetucal shapes 
Most of thPse matm.,cs, however, are unprac- 


tical for m1htary correspondence many case, so that no attentwn nce<l be given them m this text 
b If such designs were usPd, although it might be difficult to solve a smgle or even a few 
messages m the same key, the general solution described m paragraph 26 is applicable whenever 
two or more messages of identical lengths but m the same key are available for study 
Smee 


most of these deSigns are of a fixed or mflcxible character with regard to the number of letters 
that can be accommodated with one application of the design to the plam text to be enciphered, 
the production of several cryptograms of identical length m thP same key is by no means an un- 
usual circumstance 
The general solution can usually be dPpended upon to yield the answer to 
cryptograms of this category but it then becomes advisa.ble to try to ascertam the exact nature of 
the specific design or geometric figure employed, that is, to reconstruct the trani.pos1t1on matrix 
For this purpose a general method will be mdu,atPd by mcnns of a specific example, lcavmg other 
cases to the mgenmty of the student after he hM learned thP genpral method 


30 Reconstruction of transpos1t1on matrix -a Assume that the enemy is employmg an 
unknown geometric figure of rather small drmcnsions so that it appears from a study of the traffic 
that it accommodates a maxrmum of 85 lettcrs 
A long cryptogram has been mtercepted and it is 


broken up mto sections of 85 letters, whwh sections are then superimposed, as shown below 
It will be noted that there a.re 3 complete sections of 85 letters each, plus a final section of but 
49 lettcrs 
The fine.I sect10n wtll be dealt with later 


1 
2 
3 
4 
5 
6 
7 
8 9 
10 
11 12 13 14 15 
16 17 18 111 20 
21 22 23 24 25 
26 27 28 29 30 


1 TD NF R 
A 0 I S J 
F E R 0 E 
E A R Y 0 
I E P T L 
TH AV N 
2 WR TD L 
U 0 S F C 
N N T U I 
N M 0 S X 
L N 0 NP 
A T S I F 
3 M A I S V 
I T S 0 T 
H L T E S 
R I 0 V I 
Y V W NG 
P E 0 0 I 
4 GR UT S 
0 EB RM 
L R M 0 0 
E T C N N 
DYE EH 
T Q C N T 


31 32 33 34 35 
36 37 38 39 40 
41 42 43 44 45 
46 47 48 49 
l50 
51 52 53 M 55 
li6 li7 58 59 60 


1 A N N C T 
S Y 0 A A 
C E M E H 
I E I B I 
HADE X 
TC TUR 
2 W DH EB 
RN D TT 
D I Y A F 
AD AG R 
D 0 E 0 A 
A J T R E 
3 A T U A C 
0 D P 0 B 
I M N R T 
I N E S H 
0 Y N F L 
I H N R 0 


4 M 0 0 C E 
0 I B R S 
E P Y C S 
S S S F 


61 62 63 64 65 
66 67 68 69 70 
71 72 73 74 75 
76 77 78 79 80 
81 82 83 84 85 


1 RF VS T 
N N R U I 
N 0 U R T 
FF EN V 
EL N 0 E 
2 MA I 0 N 
V 0 T 0 T 
T R N 0 I 
EU ANH 
R 0 C T A 
3 LT YE X 
A E U 0 A 
E FR TE 
X YR V R 
A U I N T 


(80) 


81 


b The anagrammmg process is applied to the superrmposed complete sections, usmg the 
letter J m the first section as a startmg pomt and bmldmg up text on either side, unttl the follow- 
mg partiallv reconstructed text is obtamed 


~ M ~ 85 2 
ITT 
~ ~ M W 69 N ~ M ~ 84 3 62 ~ 29 M ll 
A C H E D R 0 A D J U N C T I 0 N F I V E F 
T E F A R M X S E C 0 N D B A T T A L I 0 N 
B A T T A L I 0 N T 0 V I C I N I T Y 0 F H 
c Exammmg thP numbers fomung tlus partial c~P sequence, note the followmg sections 


of the sequence 


40 34 45 85 2 61 
20 
28 
53 
10 


41 
35 46 84 
3 62 
21 
29 
54 
11 


They show a qmte defmill' rdahonship, h'admg to the bUspmon that the c~P sequence IS 
systematic m its compos1t1on 
The numbt>rs arc thPn written down on <..ross-section paper so that 
consecutive numbers appea1 on the same level, as i.hown m hgurc 40-A 


C~P sequence________ - --- - _ ----- 
40 
M 
45 
85 
2 
61 
20 
28 
M 
10 
69 
79 
41 
35 
~ 84 
3 
62 
21 
29 
54 
11 


'!ext -- _ ---------- --- ---1 


1 


2 


3 


Matrix rooonstructwn diagram_____ 4 


5 


6 


7 


A 
T 


B 


,__ 


,__ 


- 
40 
- 


'-- 


- 


C H E 
--- 
E F A 
--- 
A T T 


- - - 
- - - 
- - - 
- - - 
34 
- 
- - 
45 
- 
- - 
85 


~1: ~~ 
A L I 0 


- - - - 
- - -- 
28 
- - - - 


20 


- 
- - - 
61 
- 
- - -- 
2 
- - - -- 


D J ~I~~~ 
E c 0 N D B 
----- 
N T 0 V I C 


10 
- - 
- 
- - - 
53 
69 
- - - - - - 
79 
- 
- - - - - 
41 
- - - - - - 
35 
- - - - - - 
- - - - - - 


FiauBB 41>-A 


I 0 N F I v E F 
A T T A L I 0 N 
- 
I N I T y 0 F H 


11 
- - - - - - - - 
54 
- - - - - - - - 
29 
- 
- - - - - - - 
21 
- 
- 
- - - - - - 
62 
- - - --- 
- - - 
46 
3 
- - - - - - - - 
84 


d From this skeleton of what may be termed the matri.r:-reconstruction diagram it is possible 
to denve direct clues for the contmuancc and completion of the c~P sequence and the text of 
the message 
For example, it would appear that the very next column to the left should be 78, 
the one to the left of 78 should be 68, the one to the left of 68 should be 9 
Tnal gives the 
followmg 


96878403445852 
SREACHED 
F T A T E F A R 
OURBATTA 


To the right of column 11 should come columns 70 80 42 36 4 7 
Thus 


2ll M 11 70 80 42 36 4.7 
V E F I V E S E 
I 0 N T H I R D • 
OFHARMON 


82 


This, of course, speeds up the work IDvolved ID the anagrammmg p1ocess and when completed the 
text, the C-+P sequence, the P-+C sequence, and the matnx reconstruction dmgram are as 
shown m figure 40-B 
In the cells of thC' diagram there have been mserted m the upper left 


hand corner small numbers JD italics, the latter numbers bemg me1ely the term numbe1s 
applymg to the C-+P sequence 
e The matrix-reconstruction diagram ID figure 40-B shows a total of 7 levels of numbe1s 
Let the term numbers correspondmg to the consecutive C-+P sequence numbers on the• 
same level m the dmgram be set down 
Thus, for the C-+P sequence numbers 4 to 16, mclusive, 
on the first level the term numbers are 


C-+Psequencenumber ____ 4 5 6 
7 
8 
9 10 
11 
12 
13 
14 
15 16 
Term nulllber ____________ 1 3 7 13 
21 
31 
43 
55 
65 
73 
79 
83 
85 
On the second level there are two sets of consecutive C-+P sequence numbers, those frolll 48 
to 58, mclus1ve form.mg one set, those from 64 to 74, mclus1ve formIDg the other set 
Two senes 
of term numbers are therefore denved 


C-+P sequence number _____________ 48 49 
50 
51 
52 
53 
54 
55 
56 
57 58 
Term number_________________________ 
2 
6 12 
20 
30 42 
54 
64 
72 
78 
82 


C-+P sequence number ___ --------- 64 
65 
66 
67 
68 
69 
70 
71 
72 
73 
74 
Term number ___ ------------------ ___ 
4 
8 14 22 32 44 56 66 74 80 84 
What has been said of the 2d level applies also to the remaIDIDg levels, and the term nulllbers 
are therefore set down ID the followIDg tabular form 


C-+P sequence 


numbers to which 
2 
3 
4 
6 
6 
7 
8 
9 
10 
11 
12 
13 
e.pphee.ble 


1 
1 
3 
7 13 
21 
31 
43 
55 65 73 
79 83 85 
(4-16) 
2 
2 
6 12 
20 
30 42 
54 
64 
72 
78 82 
(48-58) 
3 
4 
8 14 22 32 44 
56 
66 74 80 84 
(64-74) 
4 
5 11 
19 
29 
41 
53 
63 
71 
77 
(24-32) 
5 
9 15 23 
33 45 57 
67 
75 81 
(75-83) 
6 
10 
18 28 40 
52 
62 
70 
(17-23) 
7 
16 24 34 46 
58 
68 76 
(38-44) 
8 
17 27 39 51 
61 
(59-63) 
9 
25 35 47 59 
69 
(33-37) 


10 
26 38 50 
(1-3) 
11 
36 48 60 
(45-47) 
12 
37 
(85) 
13 
49 
(84) 


P'IGUBE 410 


f There are ID all 13 sets or series of consecutive C-+P sequenc.,e numbers, IDdicatmg 


that the transposition matrix has 13 columns, the nulllber of letters m each column correspondmg 
with the number of dllferent terms ID each senes 
Thus, there is a column of 13 letters, 2 
columns of 11 letters, 2 columns of 9 letters, and so on 
This leads directly to the idea of a 
veey symmetncal matrix of the form shown m figure 42-A 


Term number______ 
l 
2 
a 
4 
5 
e 
1 
8 
9 
lo 
11 
12 
13 
u 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
20 
21 
28 
20 
ao 
31 
32 
33 
34 
35 
36 
37 
38 
39 
40 
<11 
42 
43 


C-+ P sequence____ 
4 
48 
11 
M 
24 
49 
e 
61! 
75 
17 
211 
oo 
1 
66 
76 
38 
li9 
18 
20 
51 
s 
67 
77 
so 
33 


F 
I 
R S 
T B A T 
T 
A L 
I 
0 
N F 
0 
U R T H I 
N F 
A N T R Y H A S 
R E 
A C H E 
D R 
0 
A D 
J 


Plam text ___ ------ 
D 


1 
i 
2 


'"C 


~ 
3 


~ ---------------- 4 
I 
j 


5 


6 


7 


Term number __ _ 


s 


t 
4 


G-.p sequence ___ 
26 


A L 
0 
N G U N I 
M P 
R 
0 
V E 
D R 0 
A D S 
0 
U T H W E S 
T 
0 
F 
T 
A T 
E 
F 
A R M X S 
E 
C 


E 
V E 
N S 
I 
X E 
I 
G H T 
A X P 
R 0 
P 
0 
S 
E 
Y 0 
U M 0 
V E 
Y 0 
U R B A T 
T A L 
I 
0 
N T 


IJ 
7 
5 
6 


ts 


7 


It 
St 


8 
9 
------------------------------------------------------------------------------------ 
' 
4 
8 
B 
11 
t,i 
IO 
II 
60 
SI 
41 
44 


48 
64 
49 
65 
50 
66 
51 
67 
52 
68 
53 
69 


--,----~4------;5--~5------;6------~6-----;7 __________ ;7 ______ ;8--------------~8------. 


to 
17 


t8 
38 


tB 
18 
'" 39 


18 
19 


IJ,f 
40 
"° 20 


------------~------------------------------------------------------------------------- 


38 
llO 


n 
u 
n 
u 
n 


59 
33 
60 
34 
61 


18 


1 


tlll 
45 


IJ7 
85 


IJB 


2 


I 
<- 
..._....., __ ....., __________________________________ ....., ________ _.. __ ....... --. __ _... __ ..... ____ ..._ __ ...__.... __ ...... __ ..__.... __ ..__... __ _.... __ ........... __ _._ ______________________ .___... __ _._ __ ..._~ 


FIOUBB 40-B 


F 


ii 
·\ 
:1 


I 


~1 


l 
' 
. 
? • 


41 
42 


- -- 


28 
53 
- -- 
A 
D 
- -- 
s 
E 
---- 
0 
N 
- -- 


- -- 


"' 53 
- - 
!8 - -- 


- - 


- -- 


- - 


- -- 


l 
u 
--- 


I 
118 


40-B 


43 .. 
- -- 


10 
69 
---- 
J 
u 
--- 
c 
0 
---- 
T 
0 
---- 
43 
10 
---- 
# 
69 
---- 
---- 
---- 
---- 
---- 
---- 


43 
44 
---- 


68 
76 


I 
45 
~ 
47 
48 
49 
---- - ---- 


711 
41 
3~ 
46 
M 
------- -- 
N c 
T 
I 
0 
------ - -- 
N 
D 
B 
A 
T 
---------- 
v 
I 
c 
I 
N 
---------- 
---------- 
---------- 
46 
79 
---------- 


48 
41 
---------- 
47 
35 
---------- 


48 
46 
---------- 


.fB 
84 
---------- 


45 
46 
47 
48 
49 
---------- 


36 
48 
60 
2 
6 


50 
51 
52 
5d 
M 
55 
56 
57 
58 
59 
60 
61 
62 
-------------------------- 


3 
62 
21 
29 
M 
11 
70 
80 
u 
36 
47 
63 
22 
-------------------------- 
N 
F 
I 
v E 
F 
I 
v E s 
E v E 
----- ------------- 
------ 
T 
A 
L 
I 
0 
N 
T 
H 
I 
R 
D 
I 
N 
-------------------------- 
I 
T 
y 
0 
F 
H 
A 
R 
M 
0 
N 
y v 
------------- ------------ 
66 
11 
-------------------------- 


64 
66 
54 
70 
----- 
-------------------- 
68 
67 
29 
80 
-1-------- -------------- 
61 
68 
BB 


21 
42 
22 
--------------------- ---- 
61 
69 
61 
62 
36 
63 
-------------------------- 
60 
60 


3 
47 
- ------------------------ 
-------------------------- 


50 
51 
52 
63 
M 
55 
56 
57 
58 
59 
60 
61 
62 
-------------------------- 


12 
20 
30 
u 
M 
64 
72 
78 
82 
17 
27 
39 
51 


63 
64 
65 
66 
87 
68 
69 
70 
71 
72 
73 
74 
75 
76 
77 
78 
711 
80 
81 
82 
83 
M 
8li 
--------- 
----------------------1- 


30 
55 
12 
71 
81 
43 
37 
23 
31 
56 
13 
72 
82 
44 
32 
57 
14 
73 
83 
58 
15 
74 
16 
--------- - -------------------------- - ----1- 


N x E 
N 
E M y 
p 
A 
T 
R 
0 
L 
E 
N c 
0 
u 
N 
T 
E 
R 
E 
------ - - - 
----- --------------------------,_ 
F 
A 
N 
T 
R y 
N 
0 w A 
T 
R 
0 
A 
D 
J 
u 
N c 
T 
I 
0 
N 
- --- 
- 
- 
- --------------------------------,_ 
I 
L 
L 
E 
A N 
D w A 
I 
T 
F 
u R 
T 
H 
E 
R 
I 
N s 
T 
R 
------- - - --------------------------------1- 


66 
78 
19 
8' 
86 


12 
13 
14 
15 
16 
--------- - --------------------------------- 
64 
66 
11 
14 
78 
BO 
81 
84 


55 
71 
56 
72 
57 
73 
58 
74 
--------- 
- ----- --------------------------- 
BS 
87 
11 
76 
11 
81 


30 
81 
31 
82 
32 
83 
--------- 
- ---------- - --------------------- 
68 
10 
16 
43 
23 
44 
----- --- 
- --------------------------------- 
69 
37 
------- 
- 
- --------------------------------- 
--------- 
- ---------------------- - --------- 
--------- 
- ---------------------------------- 


63 
64 
65 
66 
67 
68 
69 
70 
71 
72 
73 
74 
75 
76 
77 
78 
711 
80 
81 
82 
83 
M 
8li 
------- 
- 
- ----------------------- ---------- 


61 
4 
8 
14 
ZI 
32 
44 
M 
66 
74 
80 
84 
9 
15 
23 
33 
45 
57 
67 
75 
81 
49 
37 


32UM--41 (Face p 82) 


I 


83 
71 


2 
3 
4 


5 
6 
7 
8 
9 
-- 


10 
11 
12 
13 
14 
15 
16 
------ 
17 
18 
19 
20 
21 
22 
23 
24 
25 
---------- 
26 
27 
28 
29 
30 
31 
32 
33 
34 
35 
36 
------------------~ 
E 38 
39 
40 
41 
42 
43 
44 
45 
46 
47 
48 


50 
51 
52 
53 
54 
55 
56 
57 
58 
59 
60 
- ------'-------- 
61 
62 
63 
64 
65 
66 
67 
68 
69 
------ 


70 
71 
72 
73 
74 
75 
76 
- ------ 
77 
78 
79 
80 
81 
--- 
82 
83 
84 


85 - 


FIOUBJ:4~A. 


g. The recovery of the transposition key (for the columns of figUI"e 42-A) is now a simple 
matter. Referring to the P--+C sequence shown in figure 40-B, and noting the various columns 
in figure 42-A in which successive numbers of the P--+C sequence fall, the key number 1 of the 
transposition key obviously applies to the column containing P--+C sequence numbers 26-38-50; 
the key number 2 obviously applies to the column containing P--+C sequence numbers 1-3-7-13- 
21-31-43-55-65-73-79-83-85; and so on. The complete transposition key and the matrix are 
shown in figure 42-B. · 
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13 
1 
9 
3 
4 
8 
2· 
10 
11 
6 
5 
7 
12 


1 


2 
3 
4 


5 
6 
7 
8 
9 


10 
11 
12 
13 
14 
15' 16 


17 
18 
19 
20 
21 
22 
23 
24 
25 


26 
27 
28 
29 
30 
31 
32 
33 
34 
35 
36 


38 
39 
40 
41 
42 
43 
44 
45 
46 
47 
48 


50 
51 
52 
53 
54 
55 
56 
57 
58 
59 
60 
------------------ 
61 
62 
63 
64 
65 
66 
67 
68 
69 


70 
71 
72 
73 
74 
75 
76 


77 
78 
79 
80 
81 


82 
83 
84 


85 


FIGURE 42-B. 


h. The solution of the incomplete section of the message (the last 79 letters) now becomes a 


simple matter, since the matrix and the transposition key are both known. The matter can be 
handled as if simple transposition were involved, by outlining the matrix to contain exactly 79 
letters and inscribing the cipher text in the columns in key-number order. 
i. The foregoing p1inciples and procedure will be found quite valuable not only in facili- 
tating the anagramming of the text in its initial stages (as in subparagraph d) but also in recon- 
structing various types of matrices based upon symmetrical designs used with single transpo- 
sition (subpa.ragra.phs e-g). It should be noted that the number of l.evel8 in the reconstruction 
diagram corresponds with the number of different-length columns in the matrix; the number of 
different categorie8 of term numbers (as in figure 41) corresponds with the number of columns 
in the matrix. 
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SECTION VII 


SOLUTION OF GRILLES 


Paragraph 
Revolving grilles _______________ -------______________ ----_____ ----____________ ------------------___________ ------____ ------------------- 
31 
Solution of example _____ -------------------________ ----------_________________ ---------_______ --------------__________ ------__________ 
32 
Concluding remarks on the solution of revolving grilles_____________________________________________________________________ 
33 
Indefinite or continuous grilles __________________________ --------------------------------------------------------------·------------ 
34 


31. Revolving grilles.-a. In this type of grille 1 apertures are distributed among the cells 
of a square sheet of cross-section paper in such a manner that when the grille is placed upon a 
grid (a sheet of cross-section paper of the same size as the grille) certain cells of the grid are dis- 
closed; then when the grille is turned three times successively through angles of 90° from an 
initial position upon the grid, all the remaining undisclosed grid cells (or all but the central 
grid cell) are disclosed in turn. Correspondents must, of course, possess identical grilles and they 
must have an understanding as to its initial position and direction of rotation, clockwise or 
counterclockwise. There are two procedures possible in using such a grille. 
(1) The letters of 
the plain text may be inscribed successively in the grid cells through the apertures of the grille; 
when the grid has been completely filled the grille is removed and the letters transcribed from 
the grid according to a prearranged route. (2) All the letters of the plain text may first be 
inscribed in the grid cells according to a prearranged route and then the grille applied to the 
completely-filled grid to give the sequence of letters forming the cryptogram. The two methods 
of using the grille arc reciprocal; if the first-described method is used to encipher a message, the 
second is used to decipher the cryptogram, and vice versa. The first of the two above-described 
methods, the one in which the plain text is inscribed through the apertures, will here be referred 
to as the alpha method; the second method will be referred to as the beta method. 
b. The number of letters in a cryptogram enciphered by such a device is either a perfect 
square, when the grille has an even number of cells per side, or is 1 less than a perfect square, 
when the grille has an odd number of cells per side, in which case the central cell of the grid is 
not disclosed and hence remains unfilled. 2 


c. The manner of construction and the method of use of a grille entails certain consequences 
which can be employed to solve the cryptograms and to reconstruct the grille itself. The student 
who wishes to get a thorough grasp of the underlying principles to be explained will do well to 
prepare a grille 3 and study the properties which characterize cryptograms produced by its use. 
Three principles will be brought to bear in the solution. of grille ciphers of this type and they 
will be demonstrated by reference to the grille and message shown in figure 43. 


1 See Special Text No. 166, Advanced Military Cryptography, sec. V. 
• Of course, the cryptogram may consist of the letters produced by several applications of the same grille. 
For example, if a message of 170 letters is to be enciphered by a grille accommodating only 36 Ictters at a time, 
the message is divided up into 5 sections of 36 letters each (10 nulls being added to make the total a multiple of 
36). The total number of letters (180) here shows no properties of the type noted. Again, if the grille has a 
capacity greater than the number of letters to be enciphered, certain of the grid cells may be cancelled, so that 
the number of letters in the final cryptogram will not be a perfect square or 1 less than a perfect square. 
r-.i • Detailed instructions for the construction of revolving grilles will be found in Special Text No. 166, Ad- 
vanced Military Cryptography, sec. V. 
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MESSAGE 


YOUR LINES TO THIS-COMMAND POST CUT BY SHELL FIRE REQUEST YOU CHANGE 


THE ROUTE. 


a 


B 


d 


1 
2 
3 
4 
5 
6 
7 
8 


Grille: 8X8. 


POSITION 1 


a 


1 


2 


3 


4 


5 


6 


7 


8 


d 


2lal! 
6 
6 
7 
~ 
------- 
u 
R 


9 
W 
ll 
H 
18 
H 
U 
18 
-------- 
L 
17 
18 
19 
llO 
21 
22 
28 
:M 
------ 
I 
N 


21 
ll8 
27 
28 
29 
30 
81 
32 
------ 
E 
88 
M 
811 
86 
87 
88 
89 
40 
------ 
S 
T 0 
T 


41 
42 
48 
" 
411 
46 
47 
48 
------ 
H 
I 
S 
411 
Ill 
Ill 
112 
&8 
M 
1111 
116 
------ 
c 


117 
118 
119 
60 
61 
62 
03 
64 


b 


A 


6 
5 
4 
3 
2 
1 


b 


c 


J'IGUU 48 
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POSlTION 2 


0 
M 
1 
2 
8 
4 
II 
6 
7 
8 
------ 
M 
A 
N 


9 
W 
ll 
H 
18 
H 
U 
18 
------ 


17 
18 
19 
llO 
21 
22 
28 
:M 
------- 
D 
P 
0 
26 
28 
27 
28 
29 
30 
81 
82 
S 
T 
888'868687888940 


C 
U 
T 


41 
42 
48 
" 
411 
46 
47 
48 


411111&1112t'l8Mllllll8 


B 
Y 
S 
117 
118 
119 
60 
61 
62 
63 
84 


• 


c 


I 
•••••••••••••••••••••••••••••••••••••••••••••• 
--·--- -----------·-·-------------------- 
. ---··· -·-· 


0 


D 


q 


87 


Pos1T1ox 3 
p 
PosmoN 4 
0 


H 
0 
u c 
1 
2 
3 
' 
II 
6 
7 
8 
I 
2 
3 
4 
& 
6 
7 
8 
'---- - 
- 
- 
- - 
- 
,_ 
E 
L 
L 


9 
10 
ll 
12 
18 
H 
16 
18 
II 
W 
ll 
H 
18 
H 
U 
U 
'---- - 
- 
- 
- 
- 
- 
- 
------- 
F 
I 
R 
E 
H 
A 
N 
17 
18 
111 
llO 
21 
22 
23 
:M 
17 
18 
Ill 
20 
21 
22 
23 
2f 
'----- 
- 
- 
- 
- 
- 
- 
R 
G E 


211 
ll8 
27 
28 
29 
30 
31 
32 
'---- - 
- 
- 
- 
- 
- 
- 
E 


211 
28 
27 
28 
29 
30 
31 
32 
------ 
E 
Q 
T 
H 
E 
88 
M 
311 
36 
87 
38 
39 
40 
38 
84 
85 
86 
37 
88 
811 
40 
1---- 
- 
- 
- 
- 
- 
- 
------ 
u 


f.1 
42 
48 " 


411 
4G 
47 
411 
- 
- - - 
- 
,_ - 
- 
E 
s 


411 
110 
111 
112 
&8 
M 
1111 
116 
'----- 
- 
- 
- 
- 
- 
,_ 
T 
y. 


117 
llll 
119 
60 
61 
62 
63 
M 


'I 
.. 
.. 
FINAL GBID 
b 


0 
0 
M 
Y 
U 
C 
H 
0 
2 
3 
4 
II 
8 
7 
8 
---- 
M U E L A R N L 
9 
W 
tt 
H 
18 
H 
U 
U 


F 
H A I 
R L 
N E 
17 
18 
111 
llO 
21 
22 
28 
2f 


R I 
D N P 
G E 
0 
211 
28 
27 
28 
29 
30 
31 
n 
F 


T 
S 
T H E 
E 
Q E 
38 
M 
311 
86 
37 
38 
39 
40 
S 
C U T 
0 
U T T 
41424.3'4411464.748 
H R E 0 
I 
S S U 
411 
llO 
61 
P 
113 
M 
1111 
118 
-----·1--1-- 
T 
C B Y Y T E 
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d. The :first principle may be termed that of symmetry. When a revolving grille is in position 
1 a certain number of cells of the underlying grid are disclosed (uncovered). For ea.ch such 
disclosed cell of the grid there is a symmetrically-conesponding cell on the same grid which is 
disclosed when the grille is turned to positions 2, 3, and 4, because the apertures of the grille 
remain fixed-only their positions change as the grille is turned in the process of encipherment. 
Now two BUCCB8riH apertures in position 1 will, of course, be occupied by a plain-text digraph (alpha 
method of encipherment). When the grille reaches position 3, after a turn of 180°, the two 
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apertures concerned will disclose two cells which will also be occupied by a plain-text digraph, 
but the letters compoaing the digraph tvill be in. reverse order in. the 1>1.ain. te:&t. 
This property i8 true 
also of two BUCCeBBifJB apertures in position 2 whPn they turn up in position 4. Let the student 
verify this by means of the grille which he has constructed. Thus, referring to figure 43, at A 
is shown the grille in position 1. In the first row are shown 2 apertures, e.t coordinates 1-4 and 
1-8. At Bare shown the results of the first application of the grille to the grid. Note the letters 
Y 0 (first 2 lettcrs of message) in cells 4 and 8. Now note that the symmetrically-corresponding 
cells disclosed when the grille is in position 3 a.re cells 57 and 61 and these correspond to cells 4 
and 8 in the reverse order. The letter T in cell 57 therefore symmetrically corresponds with 
letter 0 in cell 8; the letter Yin crll 61 corresponds with letter Y in ccll 4. The same is true of all 
other letters in positions I and 3. As a consequ('nce of this property of grilles, o. single cryptogram 
can be handled as though it were reo.lly two cryptograms of identical length having certain 
cha..ro.ctcristics by means of which an assumption mo.de in one text may be verified by what it 
yields in the other text. That is, when the cryptogram is transcribed o.s a. series of letters in one 
line and these.me text is written in another line under these letters but in reversed order, then the 
superimposed letters will bear tho symmetrical relationship pointed out in this paragraph. If 
two letters in the upper line of such 0. transcription arc to.ken to form 0. digraph, the two corre- 
sponding fottcrs in the lower line must form a digraph but in reversed order in tho plain text. 
For example, if the cryptogram of figure 43 is written out o.s explained above, tho result is as 
shown at figure 44. Now the presence of the Qin position 39 suggests that it be combined with 
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a U. If the U in position 43 is taken, then the symmetrical digraph corresponding to Q U would 
be L I; if the U in position 56 is taken, the symmetrically-corresponding digraph would be M I. 
Furthermore, two apertures which are in the same column and viMch do not hafJB an. in.terwning 
aperl:ure between them, will yield a good digraph in all 4 positions of the grille. For example, note 
apertures 2-6 and 3-6 at A in figure 43. °\\'"'hen the grille is turned to positions 2, 3, and 4 they will 
disclose two sequent letters in ea.ch case. An analysis of the symmetries produced by an 8X8 
grille yields the following table, which shows what cells arc disclosed in the other 3 positions when 
an aperture is cut in any one cell in 1 of the 4 positions of t11e grille. For example, an aperture 
cut in cell 11 (position 1) will disclose grid-cell 23 when the grille takes position 2, grid-cell 54 when 
the grille takes position 3, and grid-cell 42 when the grille takes position 4. 
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The second principle may be termed that of eulv.rion.. 
On account of the system upon which 
the construction of a revolving grille is based, a. knowledge of the location of an aperture in one 
of the bands brings with it a .knowledge of 3 other locations in which there can be no apertures. 
For example, referring to A in figure 43, the presence of tho aperture at coordinates 1-4 precludes 
the presence of apertures e.t coordinates 4-8, 8-5, end 5-1. By virtue of this principle of exclu- 
sion, the number of possibilities for choice of letters in solving a cryptogram prepared by means 
of a revolving grille becomes much reduced and the problem is correspondingly simplified, as 
will be seen presently. 
· · j. The third principle may be termed that of sequence. When trying to build up text, the 
letters which follow a given sequence of plaiu-tcxt letters will usually be found to the right and 
below, that is, if the normal method of writing was used (left to right and from the top down- 
ward). For example, referring to figure 44, if the trigraph Q U E is to be built up, neither the U 
in position 5 nor the U in position 10 is very likely to be the one that follows the Q; the U in position 
43 is the most likely candi<lato because it is the first one beyond the Q. 
Suppose the U in position 
43 is selected. Then the E for QUE cannot be the one in position 40, or in any position in front 
of 40-, since the E must be beyond the U in tho diagram. 


g. In solving a grille, it will be found advisable to prepare a piece of cross-section paper of 
proper size for the grille and to cut each aperture as soon as its location in the grille becomes 
quite definite. In this way not only will the problem be simplified but also when completed the 
proper grille is e.t hand. 
SI. Solution. of e:u.mple.-a. Suppose the cryptogram shown in figure 43 is to be solved. It 


has 64 lcttcrs, suggesting o. grille 8X8. The cryptogram is first transcribed into a square 8X8, 
yielding what has already been obtained at Fin figure 43. The Q in position 39 suggests that it 
is part of a word inscribed when the grille was in position 3, since there will be 16 plain-text letters 
inscribed at ca.ch position of the grille. Then a piece of cross-section paper is prepared for 
making the grille as shown in figure 45-A, and an aperture is cut in the proper position to dis- 
close, in position 3, cell 39. It will be found that this is the aperture located at coordinates 4-2 
of the grille shown in figure 45-A. At tho same time the other 3 cells numbered 4 in the second 
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band of the grille are marked so that they cannot become apertures. The result is shown in 
figure 45-B. Conforming to the principle of sequence, the U to be combined with tho Q is 
sought to the right of the Qin figure 43-F. There are three candidates, in positions 43, 46, and 
56. · They yield: 
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<Grllle In position 3) 
39 
41 
39 
46 
:19 
.56 


Q u 
Q u 
Q u 
I 
L(=L Ip) 
I 
A(=A lp) 
I 
M(=M Ip) 


All of the symmetrical correspondents of these 3 Q U's are good digraphs and it is impossible to 
eliminate any of the three possibilities. The U in position 43 would place an aperture at coordi- 
nates 6-3 in figure 45-B; the U in position 46 would place an u.pcrturc at coordinates 6-6; and the 
Uin position 56 would place an aperture at coordinat<•s 7-8. All of tht•s<· are possible, none being 
excluded by principle 2. Suppose the Q U is followed by E. 
There are only two possibilities: 
an E in cell 51 and E in cell 63. The following possibilities are presented: 


39 
43 
51 
Q U E 
I 
L R 


(=R 
L 
I) 


39 
43 
63 
Q U 
E 
I 
L 0 
(=0 
L I) 


39 
46 
61 


Q U E 
I 
A R 
(=R 
A I) 


39 
46 
63 
Q U E 
I 
A 0 


(=O· 
A 
I) 


39 
66 
63 
Q U E 
I 
M 0 
(=0 M I) 


None of the symmetrical correspondents of the Q U E's arc impossible sequences in plain text, 
although 0 A I is not as probable as the others. 
(The 0 could be the end of a word, the AI 
the beginning of the word AID, AIM, AIR, etc.) Each of these possibilities would be tested by 
principle 2 to see if any conflicts would arise as to the positions of apertures. As in all cases of 
transposition ciphers, the most difficult part of the solution is that of forcing an entering wedge 
into the structure and getting a good start; whm this has been done the rest is easy. Note what 
the results are when the proper apertures are assumed for QUEST in this case, as shown in figure 
45-C. In position 1 this yields OUR LI ... ; in position 2 it yields two digraphs AN and UT; 
in position 4 it yields two digraphs H A a.nd R 0. 
Till' studl'l!t should note that the indicated 
digraphs A N and R 0 in positions 2 and 4, respectively, arc certain despite the fact that there is 
a space between the two apertures disclosing these letters, for the principl<> of exclusion has per- 
mitted the crossing off of this cell as a possibility for an aperture. 


I 
!I 6 
£ I t ; g 
:I 9 I l i I 
______ , __ ---------- 
_l 
: 


1 


x~i-_:_!_~JX1XJ~ 


9 XIX!z!EJX!zj£ 


g1·-;-1-;-r-L-i-~l;~,.-£-it 


! 
: 
I 
I 
t 
1_e_I z 
1 -~--:-c_i_e_iQQl---g 


·--·-·--1-1-1-----·---- 
£ z01eJzlXIX'g 


z-x1~1-;-i--;,-1--z10l 
IXX -l 
191--Y-1--;-1-£-!~- -I- 
fx"x' 
I 
I 
! 
; 


FI<rCKE 45-C'. 
(Orille Jn po,iUon :1) 


b. Enough has been shown of thl' proeedun· to nmkc furtlwr dcmonstmtion unnecessary. 
Given the sequence OUR LI one begins to build on that, assuming a word such as LINE. 
Thi~ 


yields possibilities for the placement of additional apertures in the grille; these are tested in 
positions 2, 3, 4, and so on. When any 16 consecutive letters of plain text have been established 
all apertures have been ascertained and the problem has been completed. Subsequent crypto- 
grams prepared by the same grille can be read at once. 
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c. If attempts at solution on the basis of the alpha method of using a grille have failed, the 
obvious modifications in procedure on the basis of the beta method can readily be made. 
33. Concluding remarks on the solution of revolving grilles.-a. There is nothing about the 
mechanics of revolving grilles which prevents their employment in enciphering complete words 
instead of individual letters. However, the a.ssembling of whole words in intelligible sequences 
and thus the reconstruction of the original plain text is a much easier matter than assembling 
single letters to form the words oI the original plain text 
. 
. 
. 
. 
b. In case the same grille has been employed several trmes with separate grids to encipher a 


message that is considerably longer than a single grid will accommodate (see footnote 2, par. 31b), 
the several sections each representing the set of letters enciphered on one grid ma.y be super- 
imposed and the general solution described in paragraph 26 may then be ~pplied. 


c. In case the capacity of a grille is in excess of the number required by the length of the 
text to be enciphered, either of two procedures may be agreed upon. The grid cells which would 
otherwise be unoccupied may be filled by nulls, or the grid may be left incomplete. As regards 
the former procedure, little more need be said than that the presenc~ of a few nulls will only 
delay solution a bit until the fact that nulls are being employed for this purpose becomes estab- 
lished. But the second type of procedure calls for more comment. If the grid is to be left 
incomplete it is necessary, before applying tho grille, to count the number of plain-text letters 
and to cancel from the grid a number of cells equal to the number of cells m excess of the 
total number required. The position of the cells to be cancelled must be agreed upon: commonly, 
they are those at the end of the grid. Such cells are marked so that when they bec?me expos~d 
during the rotations of the grille they will not he used. Thus, for exru~1ple, the grill~ shown m 
figure 43-A is intended for a grid of 64 letters; if the message to be enciphered contam_s onl~ 53 
letters, 12 cells of the grid must be canceled, and by agreement they may be cells 53 _to 64, mclusive. 
The solution of a single cryptogram of this sort, or even of several of them of different lengths, 
may become a rat11cr difficult matter. First of all, clues as to the dimensions of the grille are no 
longer afforded by the total number of letters i1:1 the c~ptogra':11, so that. this ~form~tion can 
be obtained only by more or less laborious expcnmentation. Grilles of vanous drmensions must 
be assumed, one after the other, until the correct dimensions have been found. ~ the second 
place the symmetrical relationships pointed out in paragraph 31 no longer obtam, so that a 


singl~ cryptogram cannot be handled as though it were constituted of two messages of identical 
length. Of course, in trying out any assumed dimensions, the 64 letters of the cryptogram may 
be written out in two superimposed lines, blanks being left for those positions which are unfilled. 
The procedure then follows the normal lines. Ab.out the most h_op.cful clues wou~d be obt~ined 
from a knowledge of the circumstances surroundmg the transmission and affordmg a basis for 
the assumption of probable words. However, were such a systen;i. em~loyed for regular com- 
munication there would undoubtedly be cases of cryptograms of identical lengths, so that the 
type of solution given in paragraph 26 will be applicable. Once a solution of this sort has been 
obtained the dimensions of the grille may be ascertained. Subsequent cryptograms may then 
be attacked on the basis of the normal procedure, with such modifications as are indicated by 
the absence of the number of letters needed to make a completely-filled grid. 
34. Indefinite or continuous grilles.-a. In his Manual of Cryptography, Sacco illustrates 


a type of grille which he has devised and which has elements ?f practical importance. An ex- 
ample of such a grille is shown in figure 46. This grille contams 20 columns of cells, and each 
column contains 5 apertures distributed at random in the column. There are therefore 100 
apertures in all, and this is the maximum number of letters which may J;>e encip~ered in one posi- 
tion of the grille. The plain text is inscribed iertically, from left to nght, usmg only as ma~y 
columns as may be necessary to inscribe the complete message. A 25-letter message would requll"e 
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but 5 columns. To form the cryptogram the lette1s are transcribed horizontally from the rows, 
ta.king the letters from left to right as they appear in the apertures. If the total number of 
letters is not a multiple of 5, sufficient nulls nrc added to make it so. In decryptogra.phing, the 
total number of letters is divided by 5, this giving the number of columns employed. The cipher 
text is inscribed from left to right and top downwards in the apertures in the rows of the indicated 
number of columns and the plain text then reappears in the apertures in the columns, reading 
downward and from left to right. 
(It is, of course, not essential that nulls be added in encipher- 
ment to make the length of the cryptogram an exact multiple of 5, for the mutter can readily 
be handled even if this is not done. In deeiphe1ment the total number of letters divided by 5 


FIGURE 46. 


will give the number of complete columns; the rrmainder left over from the division will give 
the number of cells occupied by letters in the lost column on the right.) 
b. Such a grille can assume 4 positions, two obverse and two reverse. Arrangements must 
be made in advance as to the sequence in which the various positions will be employed. 
c. The solution of a single cryptogram enciphered by one and only one position of such a 
grille presents a practically hopeless problem, for the apertures being distributed at random 
throughout the grille there is nothing which may be seized upon as a guide to the reconstruction 
of either the grille or the plain text. It is conceivable, of course, that a person with an infinite 
amount of patience could produce an intelligible text and a grille conformable to that text, the 
grille having a definite number of columns and a fixed number of apertures distributed at random 
throughout the columns. But there would be no way of proving that the plain text so obtained 
is the actual plain text that was enciphered; for it would be possible to produce several "solutions" 
of the same character, any one of which might be correct.4 


d. However, suppose a grille of this sort were employed to encipher a long message, requiring 
two or more applications of the grille. For example, in the case of the grille shown in figure 46, 
having a capacity of 100 letters per application, suppose a message of 400 letters were to be 
enciphered, requiring two obverse and two reversl'· applicntions of the grille. It is obvious that 
symmetrical relationships of the nature of those p'.linted out in paragraph 31 can be established. 
Of course, if the grille is used several times in the same position to its full capacity, producing 
cryptograms of multiples of 100 letters, then the sections of 100 letters may be supPrimposed and 
the general solution elucidated in paragraph 26 applied. 


t In this connection, see Military Cryptanalysis, Part In, sec. XI, footnote 8. 
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e. If the grille shown in figure 46 were used to encipher two messages, one of 80 letters, the 
other of 85, it would be possible to solve these messages. For by eliminating 5 letters from the 
longer message, the two cryptograms can be superimposed and handled as in paragraph 26. The 
difficulty would be in finding the 5 extra letters. Of course, if it should happen that one of the 
messages required 3 or 4 nulls and letters such as J, X, or Z were employed for this purpose, the 
nulls would be likely characters for elimination. But regardless of this, even if letters of medium 
or high frequency were used as nulls, patient experimentation would ultimately lead to solution. 
The latter, it must be conceded, would be difficult but not impossible. 
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SECTION VIII 


COMBINED SUBSTITUTION-TRANSPOSITION SYSTEMS 
Paragraph 


Reasons for combining transposition with substitution --------------·-------------------·----------·---------------------- 
35 


Other types of combined substitution-transpositions) stcmH.. ...• --·------------------------------·-------------·-----·--- 
36 


35. Rea.sons for combining transposition with substitution.-a. Transposition methods are, 
from the cryptographic point of view, rather highly regarded because they are, as "hand methods" 
go, rather rapid in operation and usually quite simple. However, from their very nature they 
entail the disadvantage that a single-letter omission or addition may render their decryptograph- 
ing difficult if not impossible for the average cryptographic clerk. But from the standpoint of 
modern cryptography the principal disadvantage of transposition methods is that they can be 
mechanized only with great difficulty-certainly with greater difficulty than is the case of sub- 
stitution methods. Only one or two attempts have been made to produce machinery for effecting 
transposition, and these have not been successful. 
b. Pure transposition, that is, transposition by itself, without an accompanying substitution 
or other means of disguise for the letters of the plain text, hardly affords sufficient guarantees for 
cryptographic security in the case of a voluminous correspondence which must be kept really 
secret for any length of time. For no matter how complex the method, or how many trans- 
positions may be applied to the letters of a single message, sight must never be lost of the fact 
that when there are many messages in the same key there are bound to be two or more of identical 
length; and when this is the case the type of solution described in paragraph 26 may be applied 
to these cryptograms, the transposition keys recovered, and then all other messages in the same 
key translated. 
c. A message may undergo monoalphabetic substitution and the resulting text passed through 
a simple transposition. When this is the case a uniliteral frequency distribution will, of course, 
exhibit all the characteristics of monoalphabeticity, yet the cryptogram will resist all attempts 
at solution according to straightforward simple substitution principles. It is usually not difficult 
to detect that a transposition is involved because there will not only be long strings of low- 
frequency letters or high-frequency letters but what is more important, there will be very few or 
no repetitions of digraphs, trigraphs, and tetragraphs, since these will be broken up by the trans- 
poaition. When a uniliterar distribution presents all the external evidences of monoalphabeticity 
and yet there are no repetitions, it is almost a positive indication of the presence of transposition 
superimposed upon the substitution, or vice versa. (The former is usually the case.) 
d. When confronted with such a situation the cryptanalyst usually proceeds by stages, 
first eliminating the transposition and then solving the substitution. It is of course obvious 
that the general solution for transposition ciphers (cryptograms of identical length in the same 
key) will not be applicable here, for the reason that such a solution is based upon anagramming, 
which in turn is guided by the disclosure of good digraphs, trigraphs, and polygraphs. Since the 
letters of a combined substitution-transposition cipher are no longer the same as the original 
plafu-text letters, simple anagra:riuning of columns formed by superimposing identical-length 
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cryptograms can yield no results, because there is nothing of the nature of plain text to guide the 
cryptanalyst in his juxtaposition of columns.1 
e. Of course if it should happen that the substitution process involves known alphabets, 
the cryptanalyst' can remove the effects of the substitutive ?ro~ess before proceeding to el~­ 
inate the transposition, even if in the encipherment the substitution came first. For example, if 
a standard cipher alphabet were employed for the substitution the uniliteral frequency distri- 
bution would give indications thereof and the cipher letters could immediately be converted 
to the normal plain-text equivalents. The latter ma! then be studied as though mere!! ~r~s­ 
position had been applied. But if unknown mixed mpher alphabets were employed, thIS imtial 
step can not be accomplished and a solution must usually wait upon the re~oval of .the tr~ns­ 
position before the substitution can be attacked. The latter may be very difficult or impossible 
where a good transposition method is used; where simple columnar transposition is used the 
removal of the transposition can be effected if the message is long enough. 
j. Of course if nothing is known about the s:ystem ?f transposition that ~a.s b~en employed, 
there is hardly anything to do but experiment with various types of transposition m an attempt 
to bring about such an arrangement of the text as will show repetitions. If this can be done, 
then the problem can be solved. For example'. suppose that a messa~e ha~ been .en?iphered by a 
single mixed cipher alphabet and the substitution text has then ~een ~scnbed withm a re~tangle 
of certain dimensions according to one of the usual routes mentioned m paragraph 5 of this text. 
Repetitions in the plain text will of comse be preserved in the substitution t~t ~ut will be 
destroyed after the transposition has been applied: The cryptanaly~t! however, m hi_s attempts 
to eliminate the transposition, may experiment with route transpositions of the vanous ~ypes, 
employing rectangles of various dimensions as suggeste~ by th~ total n~mber of letters m the 
cryptogram. If he perseveres, he will find one route ~hich he will know is correct as ~oon as he 
tries it because it will disclose the repetitions in the plain text, although the latter are still covered 
by a substitution. 
. . 
. 
. 
. 
g. Practically all the methods of transposition which may be apphed to plam text may also 
be applied to a text resulting from an initial transforma~ion by su?~titution. As already i;n~n­ 
tioned, route transposition may be used; reversed and rail-fence writmg, columnar.transposition 
with or without keying and with complete or ~comple~ rectangles are also P?ssible .. FJ:om .a 
practical standpoint, keyed-columnar transposi~1on. applied to ~ mo~oalphabeti~ s~bst~tution is 
not only a popular but also a fairly srcure combmation bec~use m this case the ehmmat1on ?f the 
transposition is a rather difficult matter. If the rectangle 1s completely filled th~ probl?m is not 
insurmountable in the case of a long messa.ge transposed by means of transposition with a rec- 
tangle of fairly small dimensions. For by assuming rectangles of various ~~ensions suggested 
by the total number of letters, cutting the columns apart, and then combmmg column~ on the 
basis of the number of repetitions produced within juxtaposed columns and between different 
sets of juxtaposed columns, it is possible to reconstmct the rectangle and thus remove the trans- 
position phase. This, however, is admittedly a slow and difficult process .even un~er the most 
favorable conditions; and if the rectangle is incompletely filled the process is very difficult. For 
in the latter case the lack of absolutely clear-cut knowledge as to the lengths of the columns,_ the 
juxtaposition of columnar mat~rial become~ replete. with nncertaintics and engenders feelmgs 
of confusion, hopelessness, and madequacy m the mmd of the cryptanalyst. However, he need 


1 It should, however, not be inferred that anagramming processes are entirely ex~luded in the cryptana~ysis 


of all combined substitution-transposition systems. In certain cases the ana~ra~mm~ process may be ~mded 
by considerations of frequency of letters or fragments of letters. A case of this kmd will be encountered m the 
solution of the ADFGVX cipher, par. 40. 
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not be wholly in despair if he is confronted with e problem of this nature in war time when 
many cryptograms become available for study. For there are special methods of solution s~itable 
to the occasion, created by special circumstances attendant upon the interception of a voluminous 
traffic. .In s~bsequcnt paragra~hs the student will come to understand what is here meant by 
the special crrcumstances and will learn of these special solutions. 
36. Other types of combined substitution-transposition systems.-a. There is no technical 


obsta?le to the ap?lication of a transposition to the text resulting from any type of substitution, 
even if the la~ter ~s polyalphab~tic ?r pol:ygraphic in nature. The obstacles, or rather object.ions, 
to such combmations are practical m therr chr. raeter-ihey arc too complex for ordinary use and 
the prevalence of errors 1:11akes them too difhcult. to handle, as a general rule. However, they 
have been and are somctrmes used even as field ciphers. For instance on the southeasten1 front 
d~rin? th~ Worl~ War, the Central Powers made use of a somewhat iIT~gular polyalphabetic sub- 
st1tut1on mvolvmg four standard alphabets and a keyed columnar transposition with incom- 
pletely-filled rectangles of. a relatively large number of columns. Nevertheless, messages in this 
system were solved by takmg advante.ge of the possibility of devising special solutions. 
. b: A few remarks .1?ay be made in re~ard to the order in which the two pro'ccsses, sub- 


3t1tut~on _and. transposition, are employed m a combined system. It is clear that when the 
subst1tut1on i~ m~noa.lphabetic it is immaterial, so far as cryptographic security is concerned, 
wh?ther substitution ~s followed by transposition or vice versa, because the equivalent of each 


plam-t~xt letter remams 6:'ed regardl~ss ?f t~1e order in which the plain-text letters appear in 
the plan:~ ~ext. However, if the substitut10n is polyalphabetic in character it is better that the 


transpositio~ process precede the substitution process, and that the number of alphabets em- 


plo:y~d b? different from the number of elements in the transposition key, if columnar trans- 
position is the case. The best situation, from a cryptographic security standpoint is when 
the two key lengths (substitution a~1d transposition) have no common factor. If the' two keys 
are of the same lcngth1 the letters m each column are enciphered by the same cipher alphabet 
and thus the cryptogram woul.d c~ntain a cert~in number of sections of approximately equal 
length, composed of letters fallmg m the same cipher alphabet. 
. c. Digra~~ic subst~tution, such as that produced by the Playfair Cipher, may be combined 
with tra~~pos1t10n to yield.cryptograms of fair security. But here again the elimination of the 
transposition phase by .t~king a~vantag.e of .speci~ circumstances or by rearranging the 'I.ext so 
as to uncover .the repetit~ons which are lllev1table m the Playfair Cipher, will result in solution. 
d. A particularly f:mtful source of combined substitution-transposition is to be found in those 


me~ods gcnera~y designated as frac~ionating systems, in which in the substitution phase each 
plalll-text letter is replaced by an eqmvalcnt composed of two or more components or "fractions" 
and then these co~ponents are subjected to transposition in a second phase. This latter may be 
followed by a thrrd phase, recombination of distributed components and a fourth phase the 
repla~em?nt of the reco~bined components by letters. Thus, such a' system comprises a 


1 
first 
substitution, a t~anspos1t1on, a :ecombination, and a second substitution.2 In the subsequent 


paragra~hs certalll systems of this sort will be dealt with in detail. They are interesting examples 
of practical systems ~f cryptogr~phy which have been used in the field of military operations in 


th~ past an~ may agam be used.~ the future. The first one to be discussed is particularly inter- 
estmg for .this. reason alone; but it is also of interest because it will serve as a model for the student 


~o follow m Ins study of methods for the solution of combined substitution-transposition ciphers 
m general. 


1 Bee Special Text No. 166, Advanced Military Cryptography, sec. XI. 
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37. Introductory remarks.--a. One of the most interesting and practical of the many 
methods in which substitution and transposition are combined within a single system is that 
known in the literature as the ADFGVX cipher.1 Jn this system a 36-character bipartite substitu- 
tion checkerboard is employed, in the cells of which the 26 letters of the alphabet and the IO 
digits are distributed in mixed order, often according to some key word. The row and column 
indicators (coordinates) are the letters ADFGVX, and, taken in pairs, the latter are used as substi- 
tutes for the letters of the plain text. These substitutive pairs are then inscribed within a rec- 
tangle and a columnar transposition takes place, according to a numerical key. The cipher text 
consists then merely of the 6 letters A, D, F, G, V, and X. 
b. The ADFGVX cipher system was inaugurated on the Western Front by the German Army 
on March 1, 1918, for communication between higher headquarters, principally between head- 
quarters of divisions and corps. When first instituted on March 1, 1918, the checkerboard con- 
sisted of 25 cells, for a 25-letter German alphabet (J was omitted), and the 5 letters A, D, F, G, and 
X used as coordinates. On June 1 the letter V was added, tbe checkerboard having been enlarged 
to 36 cells, to take care of a 26-letter alphabet plus the 10 digits. Transposition keys ranged from 
15 to 22 numbers, inclusive, and both the checkerboard and the transposition key were changed 
daily. The number of messages in this system varied from 25 a day upon the inception of the 
system to as many as 150 per day, during the last days of May 1918. The first solution was me.de 
on April 6 by the French. The cipher continued in use rather extensively until late in June but 
from that time until the Armistice the volume of messages diminished very considerably. 
Although only 10 keys, covering a period of as many days were ever solved, the proportion of 
solved messages in the whole intercepted traffic was about 50 percent. This was true because of 
the fact that the keys solved were those for days on which the greatest number of messages was 
intercepted. The same system was employed on the southeastern front from July 1918 to the 
end of the war. Keys were in effect at first for a period of 2 days and beginning on September 1, 
for a period of 3 days. In all 17 keys, covering a total of 44 days, were solved. 
c. At the time that the Allied cryptanalytic offices were working with cryptograms in this 
system only three methods were known for their solution and all three of them are classifiable 
under the heading of special solutions, because certain conditions had to obtain before they 
could be applied. No general solution had been developed until after hostilities had ceased. 
2 


1 Special Text No. 166, A'lvanred Military Cryptography, sec. XI. 


1 The general solution to be described in paragraphs 41-43 was not established until after the Armistice. 
Bad it been elaborated earlier there would no doubt have been many more solutions than were actually effected 
by the methods then available. 
(97) 


i ! 


i 


j: 
i' l ' 
' 


98 


Bec~use the:y are int?resting and ~eful some attention will be devoted to both the general and the 
special solutions. 
Smc~ the special solutions are easy to understand and serve as a good introduc- 


tion to the general solution, they will be taken up first. 
38. Spec~al solution by means of identical endings.-a. In paragraph 24 it was demonstrated 
how th~ solution of keyed-columnar transposition ciphers can be facilitated and simplified by the 


compans~n of two cryptogr~s which are in the same key and the plain-text endings of which 
~e i~e~tical. It was noted m that case that a study of the irregularly distributed cipher-text 
identities between. the two cryptograms permits of not only cutting up the text into 13ections 
that c~r~espond with the_ l?ng and the short columns of the transposition rectangle but also of 


estabhsh~g the transpositi~n key in a direct manner almost entirely mathematical in nature. 
When this has been accomplished the plain texts of these two messages are at once disclosed and 
all other messages in the same key may be read by means of the key so reconstructed. 
' 
b. The same method of solution is applicable to the similar situation, if it can be found, in 


the case of the ADFGVX system, except that one more step intervenes between the reconstruction 
of the tr~nsposi~ion _rectangle Bnd the appearance of the plain text in the rectangle: A mono- 


alph~bet1c s~bst1tution must be solved, since the text in the rows of the rectangle does not 
consist of pla~-te~t letters. bu~ of pairs of components representing these letters as enciphered by 
means of a ~1partite .substitution alphab?t. Moreover, this latter step is comparatively simple 
~hen ~here is a sufficient amount of text m the two rectangles; if not, additional material for use 
m s?lvmg t~e monoalphabet ~~be obtained from other cryptograms in the same key, if they are 


availabl~, si~ce t~e transpos1t10~ key, having already been reconstructed from the two crypto- 
gz:~ wit~ identical endmgti, will permit of inscribing all other cryptograms in the same key 
within their proper rectangles. 
c. A demonstration of the application of the principles involved in such a solution will be 
useful. The following cryptograms have been intercepted on the same date, the 20th: 


To CG 22d Brigade: 
No. l 


Ii 
10 
lG 
20 
25 
30 
XVAAX VD DAG DAD VF ADADA F X G F V X FAX A 


35 
(() 
46 
liO 
65 
80 
XVAVF AVXAD G FF X F 
F GAG F 
D GD GD 
D GAF D 


66 
70 
75 
80 
85 
90 
AA DOD XDAVG GA A DX ADFVF FDFXF G F GAV 


11/j 
100 
105 
110 
1111 
131 
AFAFX FFXFX F VD V X AFFGX AAA VA VA FAG 


1211 
130 
11111 
140 
146 
150 
DD FAG VF ADV FA V V X GVAAA FD FAX XFAAG 
DX 


_;~~- 
I' 
;. /' 


<< 


s~' 


··: 


)£. 


~r~ . 


·~\· 


,_, ... 
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No. 2 
To CG 23d Brigade: 


6 
10 
15 
20 
211 
30 


F D F F F 
F VF AD 
D VF VD 
G A F D F 
DAG AD FDFAF 


35 
40 
45 
50 
M 
60 


VAX G 0 
V X G F X 
V X DX V. 
A A A AD 
G X FF D VFAAG 


65 
70 
75 
80 
85 
90 


VG VF F 
FD AF F FXDAF X GAF D 
VF V XV DDFAD 


95 
100 
!05 
110 
115 
120 


DA A AX 
A AF FA FVFXF FAXXA ADVXA VDAVF 


125 
180 
136 
140 
145 
UiO 


D FA V X 
VA DX F 
AX FF X 
X A AV X 
X A D·X A A AV VG 


llil> 
100 
165 
170 
175 
180 


AG DX X FD FAX FD GDF F X D G X F A G D F 
FD DVD 


185 
100 


DX DA F 
AG XX A 
F GAV 


d. The delimitation and marking of identities between these two cryptograms is a procedure 
similar to that explained in paragraph 24b, except that a little more study may be necessary in 
this case because occasionally there may be considerable uncertainty as to exactly where an 
identity begins or ends. The reason for this is not difficult to understand. Whereas in para- 
graph 24b the process involves "unfractionated" letters and there are about 18 or 20 different 
letters to deal with, so that an "accidental identity" is a rather rare occurrence, in the present 
problem the process involves fractions of letters (the components of the bipartite cipher equiva- 
lents), and there are only 6 different characters to deal with, so that such "accidental identities" 
a.re quite frequent. 
Now the cryptanalyst is not able at first to distinguish between these acci- 


dental identities and actual identities and this is what makes the process somewhat difficult. 
What is meant will become perfectly clear presently. 
e. Taking the two illustrative cryptograms, the first step is to ascertain what identities 
can be found between them, and then mark off these identities. For example, it is obvious that 
if the messages end alike the last several letters in No. 1 should be found somewhere in No. 2, 
and likewise the last several letters in No. 2 should be found somewhere in No. 1. The number 
of letters in identical sequences will depend upon the length of the identical text and the width 
of the transposition rectangle. Searching through No. 2 for a sequence such aa A G D X, or 
GD X, or at least DX, the tetragraph A G DX is found as letters 151-54. The last column of No. 2 
ends with F GAV; searching through No. 1 for a sequence F GAV, or GAV, or at lea.st AV, the 
tetragraph F G A V is found as letters 87-90. These identities are underlined or marked off in 
some fashion, and search is made for other identities. It would be a great help if the width of 
the transposition rectangle were known, for then it would be possible to cut up the text into 
lengths approximately corresponding to column lengths, and this would then restrict the search 
for identical sequences to those sections which correspond to the bottoms of the colunms. Sup- 
pose the key to contain 20 numbers. Then the rectangle for No. 1, containing 152 letters, 
would consist of 12 long columns of 8 letters and 8 short ones of 7 letters; that for No. 2, con- 
taining 194 letters, would consist of 14 long columns of 10 letters and 6 short ones of 9 letters. 
If that were correct then in No. 1 the end of the first column would be either XV DD, or XV D. 
Searching through No. 2 for either of these a sequence X V D D is found as letters 84-7. Column 
1 is probably a long column in No. 1. The word probably is used because the identity may 
extend only over the letters XV D, and the next D may be an accidental similarity, since the chances 
that D will appear by pure accident are 1 in 61 which is not at all improbable. It must also be 
pointed out that a certain number of telegraphic errors may be expected, and since there are 


ii I 


;/ 


i 
I 
I 
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only 6 different letters the chances that an F, for example will be received or recorded as a D 
a.re fairly good. 
Column 1 of No. 2 ends either with VF A D 


1 
or VF A. 
Searching through No. 1, 


a seque~ce VF AD is found as letters 14-17; a sequence VF A is found as letters 34-6; a sequence 
VF F ~ts found as letters 79-82; a sequence VF AD is also found as ll'ltters 126-130; a sequence 
VF A is found as letters 130-2. Here are several possibilities; which is the one to choose? Two 
of these possibilities coincide exactly with the full sequence being sought, VF AD. Can one of 
them be eliminated as a possibility? Perhaps tables to facilitate the location of possible "breaks" 
will be helpful in me.king the elimination (see paragraph 16n). "Break tabh1s" are therefore 
constructed for the messages on the basis of rectangles of 20 columns, and are as shown below. 


0 
8 
16 
24 
32 
40 
48 
56 
64 
72 
80 
88 
96 


0 
0 
8 
16 
24 
32 
40 
48 
56 
64 
72 
80 
88 
96 
....___ ----------------------1- 


7 
7 
15 
23 
31 
39 
47 
55 
63 
71 
79 
87 
95 103 
.._____ ------------------------ 
14 
14 
22 
30 
38 
46 
54 
62 
70 
78 
86 
94 102 110 
- --------------- -------- 
21 
21 
29 
37 
45 
53 
61 
69 
77 
85 
93 
101 109 117 
--------------------------- 
28 
28 
36 
44 
52 
60 
68 
76 
84 
92 100 108 116 124 
- ----- ----------------1- 


35 
35 
43 
51 
59 
67 
75 
83 
91 
99 107 115 123 131 
..____ ----------------------,_ 
42 
42 
50 
58 
66 
74 
82 
90 
98 106 114 122 130 138 
...__ --------------------- ,_ 


49 
49 
57 
65 
78 
81 
89 
97 105 113 121 129 137 145 
"-------------------------,_ 
56 
56 
64 
72 
80 
88 
96 104 112 120 128 136 144 152 


"Break" table for No. 1 (152 letters) 


0 
10 
20 
30 
40 
50 
60 
70 
80 
90 100 110 120 130 140 


0 
0 
10 
20 
30 
40 
50 
60 
70 
80 
90 100 110 120 130 140 
~ 
---------------------- 
,_ 
---- 
9 
9 
19 
29 
39 
49 
59 
69 
79 
89 
99 
109 119 129 139 149 
- ------- ----- -------- 
,_ 
---- 
18 
18 
28 
38 
48 
58 
68 
78 
88 
98 108 118 128 138 148 158 
~ 
~ 
------------------------:- 
27 
27 
37 
47 
57 
67 
77 
87 
97 107 117 127 137 147 157 167 
--------- -------------------- 
36 
36 
46 
56 
66 
76 
86 
96 106 116 126 136 146 156 166 176 
------------------- ---------- 
45 
45 
55 
65 
75 
85 
95 105 115 125 135 145 155 165 175 185 
--------- -------------------- 
54 
54 
64 
74 
84 
94 104 114 124 134 144 154 164 174 184 194 


''Break" table for No. 2 (194 letters) 


. 
:~ .. 


·S<' 


w·· 


l·. 


·;'1, 
. .a:.. 
1-#i.-:-"· 
.•::. 
\ •.·. 


101 


From these tables it follows that as regards message No. 1 there can be a break after the 7th, 8th, 
14th, 15th, 16th ... letters but not after the 6th letter, nor after the 9th to 14th letters, nor 
after the 17th to 21st letters, and so on; as regal'.ds message No. 2 there can be a break after the 
9th, 10th, 18th, 19th, 20th, ... letters but not after the 8th letter nor after the 11th to 18th 
letters, nor after the 21st to 27th letters, and so on. Referring again to the two VFAD sequences 
in No. 1 which may correspond with the VFAD sequence in No. 2, it was found that the first 
candidate would require a break immediately after the 17th letter. But the break table for No. l 
precludes this possibility; hence the first VFAD sequence in No. 1inposition14-17 may be elimi- 
nated as a candidate, leaving the second VFAD, in position 126-130, as a. candidate. This would 
require a break after the 130th letter and reference to the break table for No. 1 shows this to be a 
possibility. Hence, the VFAD in position 126-130 in No. 1 will tentatively be accepted as 
matching the VFAD sequence in No. 2. 
Another section of the text of one or the other crypto- 
gram is next selected, with a view to establishing additional identities. To go through the 
whole process here would consume too much space e.nd time. Moreover, it is not necessary, 
for the only purpose in carrying the demonstration this far is to indicate to the student the 
general procedure and to show him some of the difficulties he will encounter in the identifica- 
tion of the similar portions when the text is composed of only a very limited number of different 
letters. In this case, after more or less tedious experimentation, the hypothesis of a key of 20 
columns is established as correct, whereupon two sets of 20 identities are uncovered and the 
identities are found to be as shown below. 


No.1 


6 
10 
16 
20 
23 
30 
XV A AX VD DAG DADVF AD AD A 
F X G F V 
X FAX A 
- 
-......--- 
1 
2 
3 
4 


36 
40 
41i 
liO 
li6 
60 
XV AV F 
AVXAD G FF X F 
F G A G F 
D GD GD 
D GAF D 
---- 
5 
6 
7 
8 


86 
70 
76 
80 
8li 
\lO 


A ADD D XDAVG GA AD X 
AD F VF F D F X F 
G F GAV 
- 
9 
10 
11 
12 


115 
100 
lOli 
110 
116 
131 


AF AF X FF X F X 
F VD V X AF F G X 
A A AV A VA FAG 
---- 
13 
14 
15 
16 


128 
130 
1311 
140 
H6 
lliO 


DD FAG VF ADV FAVVX G VA A A FD FAX XFAAG 
-....- 
17 
18 
19 


DX -20 


Jl'JOUBJI f7. 
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No. 2 


II 
10 
111 
20 
211 
30 
FD FF F F VF AD D VF VD GAF D F DAG AD F D F A F 
1 
2 
3 


311 
40 
411 
M 
55 
60 
VAX GD V X G F X V X DX V A A A AD G X FF D VF A AG 
-.......-- 
---- 
4 
5 
6 


ea 
70 
711 
80 
86 
go 
VG VF F FD AF F F X DA F X GAF D VF V XV DD FAD 
7 
8 
9 


911 
100 
1011 
110 
1111 
120 
DA A AX A A F F A F V F X F FAX X A ADV X A VD AV F 
--..--.... 
10 
11 
12 


126 
130 
131i 
140 
Hll 
130 
D FA V X VA DX F AX FF X X A AV X X AD X A A AV VG 


13 
14 
-- 
15 


133 
160 
IM 
170 
175 
180 
AG DX X F D F A X F D G D F F X D G X FAG D F FD DVD 
' 
16 
17 
18 


1815 
190 
DX DA F AG XX A F GAV 


19 
20 


FIGllBB 47-Contlnued 


j. A table of equivalencies 3 is then drawn up: 


No. L _________ 1 2 3 4 5 6 7 8 9 10 
11 
12 
13 
14 
15 
16 
17 
18 
19 20 


No. 2 ___________ 9 6 8 10 13 11 17 2 19 15 
7 
20 
14 
12 
5 
18 
1 
4 
3 
16 


Since the rectangle for No. 2 has 2 more letters in the last row than the rectangle for No. 1, 
two chains of equivalents at two intervals are constructed. Thus: 


1 
2 
1 
4 


3 
4 


9 
10 


II 
6 
19 
15 


7 
8 
3 
5 


9 
101112 


8 
2 
13 
14 


13 
14 
6 
12 


1ll 
16 
11 
20 


17 
18 
7 
16 


19 
20 


17 
18 
These chains must now be united into a single chain by proper interlocking. Since cryptogram 
No. 1 has 12 long columns, and since the identities of these 12 columns are now known (1, 3 
1 
5, 7, 9, 12, 13, 14, 16, 17, 19, 20), the interlocking of the two chains and hence the transposition 
key must be this: 


1 2 
3 
4 5 
6" 7 
8 
9 10 
11 
12 
13 
14 15 
16 17 
18 19 20 


7 5 17 
13 
1 14 9 
12 
19 20 
3 
16 
8 
18 
2 
4 
6 
10 
11 
15 


g. The two cryptograms may now be transcribed into their proper transposition matrices 


as shown in figure 48. 
' 


1 It is necessary to remark that in setting up the table of equivalencies, after determining the width of the 
rectangle, that message which has the lesser number of long columns is used as the basis for the normal sequence 
1, 2, 3, • • • . If the one having the greater number of long columns is employed as the base the reconstructed 
key will be reversed. 
' 
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No.1 
No. 2 


7 
II 17 13 1 14 9 12 19 20 3 16 8 182461011111 
7 
II 17 13 1 14 9 12 19 20 3 u 8 ~ 2 ' 
6 10 11 111 
FXDAXFAFVXAVGVAFAVAF 
AFXVFVAFFFFAAFDFAFAX 
GVFFVXAXAXDADFGVDGDF 
AXFDDAFAFADAFFVVDAFA 


AAAAAFDFAFAVDADXGGFG 
GVDAFDDXDGAAFXFAGDFA 
GVGFAVDGAADAGVAFFAVX 
VXFVFXVXDXGVFDVXXDAV 
FFVXXDDFFAAFAVDAFAFA 
GDAFFFFAVXAVXGDGFAFX 
DAFFVVXGDGFAFXVXXDFA 
VXXDFAVADADGDXGDFAVX 
GVAFDXDAFDXGDGFAFXDA 
FVFFVXXDDFFAAFAVDAFA 
DXDXDAAVAXGD 
FADAFFVVXGDGFAFXVXXD 
FAGVAFDXDAFDXGDGFAFX 
DADXDXDAAVAXGD 


FIGllBB 48. 


h. A frequency distribution is now made of all the bipartite pairs, so as to solve the encipher- 
ing checkerboard. There is no necessity for going through this part of the solution, for it falls 
along quite normal lines of monoalphabetic substitution. The two plain-text rectangles are 
shown in figure 49. 
The checkerboard 4 is found to be as shown in figure 50a. 


No. 1 


7 
II 
17 13 
1 J4 
9 12 
19 20 
8 
18 
8 18 
2 
' 
8 
10 
11 
111 


H 
A 
v 
E 
0 
R 
D 
E 
R 
E 
F X DA 
X F AF vx AV 
GV 
AF AV 
AF 
D 
c 
0 
M 
M 
A 
N 
D 
I 
N 
G V F F vx AX 
AX 
DA 
D F G V D G D F 
G 
G 
E 
N 
E 
R 
A 
L 
2 
3 
AA 
AA 
AF 
D F AF AV 
DA 
DX 
G G F G 
D 
B 
R 
I 
G 
A 
D 
E 
T 
0 


G V G F AV 
D G AA 
DA 
G V AF FA v x 
c 
0 
u 
N 
T 
E 
R 
A 
T 
T 
F F vx XD 
D F FA AF AV 
DA 
FA FA 
A 
c 
K 
w 
I 
T 
H 
0 
u 
T 
DA FF vv X G D G FA F X v x X D FA 
D 
E 
L 
A 
y 
w 
I 
T 
H 
A 
G V AF DX 
DA 
FD XG 
D G FA 
F X DA 


L 
L 
A 
R 
t4 
s 


DX 
DX DA 
AV 
AX 
GD 


FIOll'BB 41). 


' Since the second cryptogram is addressed to the CG 23d Brigade and the first cryptogram mentions that 
the commander of that brigade has been ordered to do so and so, the solution of the groups GG ( .... 2) and FG 
( .... 3) is made by inference. This gives the placement of these two digits in the cipher square. 


; ; 


; 


I 
. ' 
j ; 
l ! 


i' 
i ; 
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No. 2 


7 
5 
17 13. 
1 14 
9 12 
19 20 
3 16 
8 18 
2 
4 
6 
10 
11 15 


E 
x 
p 
E 
c 
T 
E 
N 
E 
M 
AF xv 
F V 
AF 
F F 
FA 
AF 
D F 
AF 
AX 


M 
y 
A 
T 
T 
A 
c 
K 
A 
T 
AX 
FD 
DA 
FA FA 
DA 
FF v v 
DA 
FA 


D 
A 
y 
L 
I 
G 
H 
T 
s 
T 
G V 
DA 
F D 
DX 
D G 
A A 
F X 
FA 
GD 
FA 


0 
p 
H 
0 
L 
D 
y 
0 
u 
R 
v x 
F V 
F X 
v x 
DX 
G V 
F D v x 
X D 
AV 


s 
E 
c 
T 
0 
R 
w 
I 
T 
H 
G D 
A F 
F F 
F A 
v x 
AV 
X G 
D G 
F A 
F X 


0 
u 
T 
F 
A 
I 
L 
s 
T 
0 


v x 
X D 
F A 
VA 
DA 
D G 
DX 
G D 
F A 
v x 
p 
c 
0 
u 
N 
T 
E 
R 
A 
T 
F V 
FF v x 
X D 
D F 
FA 
AF 
AV 
DA 
FA 


T 
A 
c 
K 
w 
I 
T 
H 
0 
u 
FA 
DA 
FF v v 
X G 
D G 
F A 
F X 
v x 
XO 


T 
D 
E 
L 
A 
y 
w 
I 
T 
H 
F A 
G V 
A F 
DX 
DA 
F D 
X G 
D G 
FA 
F X 


A 
L 
L 
A 
R 
M 
s 
D A 
DX 
DX 
DA 
AV 
AX 
GD 


F'IGUBB 49-Contlnued. 
2nd component 
A 
D 
F 
G v x 
A 
D 
F 
G v x 
A 
D 
F 
G v x 


G 
E 
R 
M 
G 
E 
R 
M 
G 
6 
E 
5 
R 
M 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
A 
N 
I 
L 
A 
N 
I 
L 
A 
! 
N 
I 
8 
L 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
T 
y 
c 
3 
p 
H 
T 
y 
c 
3 
p 
H 
T 
y 
c 
3 
p 
H 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
s 
B 
2 
D 
F 
s 
B 
2 
D 
7 s 
B 
2 
D 
4 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
K 
0 
F 
K 
0 
F 
6 
J 
0 
K 
0 
- 
- 
- 
- 
- 
- 
u v w x 
- 
- 
---v-1--w 


- 
- 
Q u 
x z 
- 
- 
- 
- 
- 
- 
(Q) u v w x (Z) 


F1GUBBliClll. 
FIGl111E 50b. 
F1GUBB 5()e, 


i. Speculating upon the disposition of the letters within the enciphering checkerboard, it 
becomes evident that the key phrase upon which it is based is GERMAN MILITARY CIPHERS. 
The fact that the digit 2 follows B and the digit 3 follows C suggests that the digits arc inserted 
immediately after the letters A, B, C, ... , as they occur in the mixed sequence. Note the cells 
which still remain vacant after the key word mixed sequence is fully developed in the checker- 
board, and all the letters which do occur in the two messages are inserted in their correct cells 
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(fig. 50b). The complete checkerboard may therefore be taken almost certainly to be as shown 
in figure 50c. 
The date (20th) indicates that the transposition key will have 20 numbers in it. 
The transposition key was evidently derived from the first 20 letters of the mixed sequence: 
G E R M A N I L T Y C P H S B D F J K 0 
7 s n 13 1 w u ll ~ 20 s ~ s 18 2 • 
o m u u 


39. Special solution by means of identical beginnings.-a. In paragraph 23 was demon- 
strated the method of solution based upon finding two cryptograms which are in the same key 
and the plain texts of which begin with the same words. The application of this meth-:>d to the 
corresponding situation in the case of the ADFGVX system should by this time be obvious. 'l'he 
finding of identical sequences is somewhat easier in this case than in the case of identical endings 
because the identities can be found in parallel progression from the beginning to the end of the 
two cryptograms being compared. Moreover, the discovery of two cryptograms with similar 
beginnings is easier than that of two with similar endings because in the former case the very 
first groups in the two cryptograms contain identities, whereas in the latter case the identities 
are hidden and scattered throughout the texts of the two cryptograms. On the other hand, the 
complete solution of a case of identical endings is very much more simple than that involving 
identical beginnings because in the former case the establishment of the identities carries with it 
almost automatically the complete reconstruction of the transposition key, whereas in the latter 
this is far from true and additional cryptograms may be essential in order to accomplish this 
sine qua non for the solution. 
b. The following represent 8 cryptograms of the same date, assumed to have been enciphered 
by the same key. 
No. 1 


VD D FA X FA AX 
D X G G F 
F VF X F 
G X DX G DGAGF 
AG DAD VG GD A 
A AD XX DX AF F 
A AD AF DFFDA 


No. 2 
G X DD A 
DD GDF VG X AX XX G X G 
A A A AD FAD DX 


AV DX F 
XAD 


No. 3 
XDAAA G X DD X 
VF F VD GAD FD 
X A A AG DFADG 
AF DAD 
G VG D V 
FD F X A 
G F X AF AF AX D 
DD D FD 


XAXVA DX F X F 
D GAG F 
G GADD AG D G X 
AVGDG 
AD AF A 
X FA AG VA AG A 
FD VD V 
DX FD A 
X FD FF 
GD X D V 
DAD AV 
D A D D D 
GAD AG 
A A AFG GD X AX 


F G V X D 
D GD D F 
AF AG V 
AFG X G VD DAX X D VF F 
FF DX G VG D F G AV AD A 
X DA FA AF D G F 
VFXXX 


A AG AG AF D G X 
AF AF X 
X G GAG A AF FA AF D GA 
GAF V X 
D G G F G DA A AF DAD AD XV VAX FVADD 
GAFF F 
GXAXD FD D F X 
A A A A A 


No. 4 
AFG F X 
AG X AG 
X DD AF AAXAV GD DD D FAFGV 
DGDXA FD X AX 
G F GD D 
VA DX A 
X G FAX FDADD 
GD 
No. 5 


XAAAD D GA AG DDDXF FA VG A 
XDGGD FF AVA 


DAAXA GDXDX XXXDG VF AD A 
D FF FF 
V VG FD 


X FD G G DAXDG ADFD 


:1 
·i : ~ 
I 


11 
! . 
I . 


11 


i: 
:1 
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No. 6 


XDAAV DXDGF XVGDD AVGXA DXAAD XGGAA 
GDFDA AAGAX DVFDF DFFDD FDDFX FXXFD 
FDXAX GAXFF VDVAF GVDVD DDAGD GGDAA 
GGFDD DVFFV VAGVA XAAGG XGXDD DADXF 
ADFFG DGFDA AFGAX FFDVD DDAGA FADAV 
D D D A V G A V A D 
F G D D F 
F D G D V 
D G G X A X A X D A 


DXDVF FXVAX GFDAG XFFFF AAXDA FVDXG 
XFDAG AGAVD VAGAF DGDAV VDDDD DFXGV 
AFFAA FFFDV DFFAF DAGDG GAAAF DXAXA 
VAXDA GADXD VFAFF FGDDA DDDFA GDFAX 
D G 
No. 7 


AGFGV DDDDF DDFXF DDGDF AXVDD VDVXA 
DDAXX AADDF AGGFF AXDDG XDFAD DFDGD 
D V A X A X F X D A 
F X D D G 
F X G D V G F F G X 
D A D F A 
DDAFF VDGXA ADXFX GVADA XGXAG AGDGV 
X DD V 


No. 8 


DFGFX DFAFF XDXAG ADGGG DDFGA XGVDF 
VVFDA AAXGD AVDVA DDGVD AFAG 


The cryptograms have been ex<.tmined for identical beginnings, and Nos. 3 and 6 apparently 
begin alike, identical portions being underlined as shown in figure 51. 
Now the number of 
identical sections in the two cryptograms is 15; this indicates that the width of the transposition 
rectangle is 15. Therefore, No. 3 (290 letters) has 5 long columns of 20 letters and 10 short 
columns of 19 letters [(15X20)-10=290]. No. 6 (302 letters) has 2 long columns of 21 letters 
and 13 short columns of 20 letters [(15X21)-13=302]. 
Th~ identical sections in No. 3 and 
No. 6 having been marked off as shown in figure 51, the next step is to transcribe the texts into 
their correct column lengths as given by the study of identical sections, writing them merely 
in their serial order, as shown in figure 52. In this transcription no serious difficulty is usually 
encountered in the division into correct column lengths, this process being guided by the identical 
sequences, the number of letters between the identical sequences, and the maximum and minimum 
lengths of the columns as calculated from the dimensions of the rectangle. Whenever difficulties 
are encountered in this process, they are brought about by accidental identities of letters before 
and after the true or actual identical sequences. In the present case no such difficulties arise 
except in going from column 12 to column 13. The identical sections for column 13 here consist 
of the sequence AF FA A F; if these sections are placed at the head of column 13, it leaves column 
12 one letter short at the bottom in each diagram. 
This means that the initial A's in these 
identical sequences represent an accidental identity; these A's belong at the bottom of column 
12 in each diagram, and the true identical sequences are FF A AF, and not A F F A AF. In 
some cases there may be many more instances of such accidental identities before and after the 
true identical sequences. Another thing to be noted is that the identical beginnings in this 
case run along for at least 4 complete rows and pa.rt of the fifth row in the transposition rectangle. 
Therefore, the identical sequences should consist of not less than 4, and not more than 5 letters; 
any letters in excess of 5 in any identical sequence are accidental identities. There are several 
such accidental identities in the case under study, viz, in columns 5 and 12. 
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No. 3 


XDAAA GXDDX VFFVD GADFD XAAAG DFADG 
1 
2 
AFDAD GVGDV FDFXA GFXAF AFAXD DDDFD - 
3 
4 


XAXVA DXFXF DGAGF GGADD AGDGX AVGDG 
- 
5 
ADAFA XFAAG VAAGA FDVDV DXFDA XFDFF 
- 
6 
7 
G D X D V 
D A D A V 
D A D D D G A D A G A A A F G G D X A X 


8 


FGVXD DGDDF AFAGV AFGXG VDDAX XDVFF 


9 
10 
FFDXG VGDFG AVADA XDAFA AFDGF VFXXX 


11 
AAGAG AFDGX AFAFX XGGAG AAFFA AFDGA 
12 
13 


GAFVX DGGFG DAAAF DADAD XVVAX FVADD 


14 
GAFFF GXAXD FDDFX AAAAA 
15 


No. 6 


XDAAV DXDGF XVGDD AVGXA DXAAD XGGAA 


1 
2 
GDFDA AAGAX DVFDF DFFDD FDDFX FXXFD 


3 


FDXAX GAXFF VDVAF GVDVD DDAGD GGDAA 
4 
5 
GGFDD DVFFV VAGVA XAAGG XGXDD DADXF 


6 
ADFFG DGFDA AFGAX FFDVD DDAGA FADAV 


7 
8 


DDDAV GAVAD FGDOF FDGDV DGGXA XAXDA 


9 


DXDVF FXVAX GFDAG XFFFF AAXDA FVDXG 
10 
11 


XFDAG AGAVD VAGAF DGDAV VDDDD DFXGV 


12 
AFFAA FFFDV DFFAF DAGDG GAAAF DXAXA 


13 
14 


V A X D A 
G A D X D V F A F F 
F G D D A D D D F A 
G D F' A X 
15 
DG 


FIGVH 51. 
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No. 3 


2 
3 
4 
6 
7 
8 
g 
10 
11 
12 
13 
H 
16 


x 
D 
D 
F 
D 
A 
D 
D 
G x A 
A F 
A 
A 
I 
,_____ - 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
,_ 


D x v 
D 
D 
G F 
A 
D 
D x G F 
A F 
' 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
1- 
I 
A 
A F x A v F G D v 
D 
A 
A 
A F 


I 
,__ - 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
1- 
A A D 
A 
G A G A E F 
A F 
A F F 
,___-------------1- 
A A f: 
~ D A Q A A F F D F D G 
,_____ ________ -=- - - - - _:::__ 
G G X V G G X A F F A G D A X 
- 
- 
,__ _____________ ,_ 


X D A 
A X A D F A F A X G D A 
,__ _____________ ,_ 


D F G D A F V G G D F A A A X 
--------------- 
D A F X V D D G V X D F G D D 
1---------------1- 
x D X F G V A D A G G A A X F 
r---------------1- 
v G A X D D D X F V F F F V D 
______________ ,_ 
F A F F G V A A G G V X V V D 
,__ _____________ ,_ 


F F A D A D V X X D F X X A F 


-1--1--~------------1- -1---I- 
v D F 
G D X D F 
G F 
X G D X X 
,___-------------1- 
D A A A A F A G V G X G G F A 
L---------------1- 
G D X G F D D V D A X A G V A 
L---------------1- 
A 
G 
D 
F 
A 
A 
D 
X 
D 
V 
A 
G 
F 
A 
A 
,_____ _____________ _ 
D V D G X X D D A A A A G D A 
,__ _____________ ,_ 


F G D G F F G D X D G A D D A 
,_____ _____________ _ 
D A A 
A 
G 


FIGURE 62. 
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No. 6 


2 
345678111011121314141 


x 
D 
D 
F 
D 
A 
D 
D 
G x A 
A _!_l~I~ 


D x v 
D 
D 
G F 
A 
D 
D x G F 
A F 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- --- 
,_ 


A 
A F x A v F G D v 
D 
A 
A 
A F 
- 
- 
- 
- 
- 
- 
--- 
- 
- 
- 
- 
- 
- 
- 


A A D 
A G A G A E F 
A F 
A F F 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- --,_ 
v 
D E 
~ D x Q F F 
.E 
.E 
D 
.E 
Q Q 


- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
D x 
D 
G Q A G A 
D x v Q F x 
D 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
,_ 
x G F 
A G A F 
D 
G v 
D 
D 
F 
A 
D 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
D 
G F x 
D 
G D 
A 
D 
A x A 
D x A 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
G A 
D 
F 
A G A v v x G v v 
A 
D 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
,_ 


F 
A 
D 
F 
A x A 
D 
D 
G x v 
D v 
D 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
,_ 
x G F v G G F 
D 
G F F 
D 
F 
A 
D 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
,_ 


v 
D 
D 
D 
G x G D 
G D 
D 
D 
F x F 
- 
- 
- 
- 
- 
- 
- 
- 
-- - 
- 
- 
- 
- 
,_ 


G F 
D v F 
D 
A 
A x A 
A 
D 
A 
D 
A 
- 
- 
-- - 
---- - 
- 
- 
- 
- 
- 
- 
- 
,_ 


D 
D 
F 
A 
D 
D x v 
A 
G G D 
F 
A G 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
D 
A x F 
D 
D 
F G x x A 
D 
D 
G D 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
,_ 


A 
A F G D 
A F 
A 
A F G F 
A 
A F 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
,_ 
v 
A x v v 
D 
D v x F 
A x G D 
A 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
G G x 
D 
F x v 
A 
D 
F v G D x x 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
1- 


x A F v F F 
D 
D 
A F 
D v G D 
D 
- 
- 
- 
- 
- 
- 
- 
- 
--- 
- 
- 
- 
- 
- 
A x D 
D v A 
D 
F 
D 
A v A G v G 


f- - 
- 
- 
- -1-- 
- 
- 
- 
- 
- 
- 
- 
v 
F 


Fmun11: 52-Contlnued. 


c. Now comes the attempt to place the columns in proper sequence in the respective trans- 


position rectangles. Since No. 6 has only 2 long columns, viz, 5 and 14, it is obvious that these 
two columns belong at the extreme left of the rectangle. Their order may be 5-14 or 14-5; 
there is no way of telling which is correct just yet. Since No. 3 has 5 long columns, tiiz, 3, 4, 5, 
7, 14, and since from No. 6 it has been ascertained that 5 and 12 go to the extreme left, it is 
obvious that columns 3, 4, and 7 occupy the third, fourth, and fifth positions in the rectangles. 
Their order may be any permutation of the three numbers 3, 4, and 7; their exact order must be 
ascertained by further study. 


3241515-41-8 


: I 


1.1 
ii 
I' 
·' 
!j 
! ' 
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d. In this study, to fix the exact order of the columns and thus to reconstruct the transposi- 
tion key, advantage can be taken of the diverse lengths of other cryptogrJms that may be 
available in the same key. In tills case there are 6 additional cryptograms, Nos. 1, 2, 4, 5, 7, 
and 8, suitable for the purpose. The following calculations are made: 


I 
Number of column• 


Cryptogram 
'l'otal number I Lengths of _ ;:::;-=__, __ Short -= 


No. 
of letters 


1 


columns 
----·----i----- --- 
1 
60 
4 
All same length 
2 
38 
3 and 2 
s 
I 
1 
4 
62 
5 and 4 
2 
1 
13 
5 
74 
5 and 4 
14 
I 


1 
7 
124 
9 aud 8 
4 
11 
8 
54 
4 and 3 
9 
I 


6 


Now No. 7 has 4 long columns, and these must consist of 4 columns from among the 5 already 
ascertained as falling at the extreme left, viz, 3, 4, 5, 7, and 14. Columns 5 and 14 have further- 
more been placed in positions 1-2, 1eaving columns 3, 4, and 7 for positions 3-4-5. Which 
of these three possibilities is to be omitted as a long column in No. 7? A means of answering 
this question involves certain considerations of general importance in the cryptanalysis of this 
type of system. 
e. Consider a transposition recta.ngle in which the number of columns is even, and consider 
specifically the first pair of columns in such a rectangle. The combinations of bipartite compo- 
nents formed by the juxtaposition of these 2 column.i;; correspond to plain-text letters, and there- 
fore the distribution of the bipartite digraphs in these columns will be monoalphabetic in char- 
acter. The same is true with respect to the bipartite components in the third and fourth columns, 
the fifth and sixth columns, and so on. Hence, if a long cryptogram of this nature is at hand, 
and if the 2 columns which belong at the extreme left can be ascertained, then a distribution of 
the bipartite digraphs formed by juxtaposing these columns should not only be monoalphabetic, 
but also this distribution, if it is at all normal, will afford a basis for matching other columns which 
will produce similar distributions, for the text as a whole is monoalphabetic. In this way, by 
proper matching of columns, those which really go together to form the pairs containing the 
bipartite equivalents of the plain-text letters can be ascertained. From that point on, the solu- 
tion of the problem is practically the same as that of solving a columnar transposition cipher 
with nonfractionated letters. 
j. But now consider a plain-text rectangle in the ADFGVX system, in which the number of 
columns is odd, and consider specifically the first pair of columns in the rectangle. Now only the 
alternate combinations of bipartite components in these columns form the units of plain-text 
letters. The same is true of the bipartite compoPents of the third and fourth, the fifth and sixth 
columns, and so on. In all other respects, however, the remarks contained in subparagraph e 
apply equally to this case where the width of the rectangle is odd. 
g. Returning to the problem under study, it has been ascertained that columns 5 and 14 fall 
at the extreme left. Whether their correct order is 5-14 or 14-5 cannot at the moment be ascer- 
tained, nor is it essential. The thing to do is to make a distribution of the bipartite pairs and 
see what it is like. Since the width of the rectangle here is odd, only the 1st, 3d, 5th, ... pairs 
down the columns can be distributed in a. frequency square. The results are shown in Fig. 53. 
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No. 3 
No. 6 
- 
- 
Col. Col. 
Col. Col, 
...L_!! 
~ 


1 
D 
A 
1 
D 
A 
D 
A 
D 
A 
3 
A 
A 
3 
A 
A 
G F 
G F 
D 
D 


2D COMPONENT 
5 
5 
D 
D 
G A 
G x 
A 
D 
F 
G 
V 
X 


7 x D 
7 
G A 
A 
A 
D x 
A 
9 v D 
9 
A 
A 
~D 
G x 
A v 


p.1( 
ii; 


l1IJ 
I 
_I_ 
-- 
-- 


II 
II 
I 
I 
------------ 
11 
D v 
11 
G A 
~F 


G v 
G x 


:ii 
0 


13 
A 
A 
13 
F 
D 
OG 


D x 
D 
A 
fi1 .... v 
15 
A 
F 
15 
D 
G 


Ill 
- --------,_ 


II 
>------------- 


II 
I 
------------ 
F v 
D 
A 
x 
I 


17 
A 
A 
17 v D 
x D 
F x 
19 
F 
D 
19 
F 
D 
A 
G 
v v 
21 
v F 


1''1GVBB 53, 


h. The distribution is fairly good. Five occurl'ences of AA are noted, 3 of FD. 
These must 
represent high-frequency letters. The q, (Phi) test for monoalphabetieity may be applied. 


Expected value of {for plain 'text=.0667X21 X20=28.01 
Expected valueof q, for random~text = .0385 X 21 X 20=16.17 
Observed value of</> in this case=(5X4)+(2X1)+(2X1)+(3X2)+(2X1)+(2X1)=34 


The observed value of <Pis considerably greater than the expected value for plain text and more 
than twice as much as the expected value for mndom text. Using the distribution in figure 53 as 
a basis, an attempt is made to add to the 5-14 combination a column selected from among columns 
3, 4, and 7, so that the second, fourth, sixth ... pairs down the second and third columns in the 
rectangle will give bipartite pairs that will conform to the distribution noted in figure 53. Since 
the results sought will be very materially affected if the combination 5-14 should rrally be 14-5, 
all possible combinations of 5-14 and 14-5 with 3, 4, and 7 must be tried. The various combina- 
tions tested are shown in figure 54. 


. ; 
: ' 


i 
I 
. 
I, 
! i 


I I 
I 
I 


1 
2 
3 
4 
5 
6 
7 
8 
9 


10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 


·2 


3 
4 
5 
6 
7 
8 
9 


10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


( 1) 


~ 
DAD 
D A V 
A A F 
G F D 
D D F 
GA X 
X DA 
A A G 
V D F 
G XX 
D V A 
G V F 
A A A 
DX F 
A F A 
F V X 
A AD 
X DD 
F D D 
A G D 


( 1 ) 
~ 
D A D 
D A V 
A AF 
G FD 
D D F 
G X D 
GAF 
DX F 
A AD 
AV D 
GAF 
G X D 
F D D 
DA F 
D G X 
D A F 
VD X 
F XX 
F D F 
V VD 
VF 


(2) 


.!i...ll....i 
D A F 
D A D. 
A AX 
G F A 
DD X 
G A V 
X DA 
A AD 
VD X 
G X F 
D V X 
G V F 
A AD 
DX G 
AF A 
F V G 
A A F 
X D G 
F D G 
AG A 


(2) 


~ 
DA F 
D A D 
A AX 
G F A 
DD X 
G X G 
GA A 
DX X 
A AF 
AV F 
G A V 
G X D 
F D V 
DA A 
D G F 
D A G 
VD V 
F X D 
F D V 
V V D 
V F 
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No. 3 


(3) 
(4) 
( 5) 


..WW 
~ ~ 


D A D 
A D D 
A D F 
D A F 
ADV 
A D D 
A AF 
A AF 
AAX 
G F G 
F GD 
F GA 
D D D 
D D F 
DD X 
G A X 
AG X 
AG V 


X DD 
DX A 
DX A 
A AV 
A AG 
A AD 


V D D 
D V F 
DVX 


G X A 
X G X 
X G F 
D V D 
VD A 
VD X 


G VA 
VG F 
VG F 
A AV 
A A A 
A AD 


DX D 
X D F 
X D G 
A F A 
FA A 
FA A 
F VD 
VF X 
VF G 
A AD 
A AD 
A AF 
X DD 
DX D 
DX G 
F D G 
D F D 
D F G 
A G A 
GAD 
GA A 
No. 6 


(3) 
(4) 
( 5) 


...!...li...! 
.!W...J 
~ 


DAD 
ADD 
AD F 
D A F 
ADV 
ADD 
A A F 
A AF 
A AX 


G F G 
F G D 
F G A 
D D D 
D D F 
DDX 


G X G 
X GD 
X G G 
GAF 
AG F 
AG A 
D X.D 
X D F 
XDX 


A A A 
A AD 
A AF 


AV A 
VA D 
VA F 
GAF 
AG F 
AG V 


G X G 
XGD 
XGD 


FD A 
D FD 
D F V 


DAX 
AD F 
AD A 
D G F 
GD X 
GDF 
DA F 
AD F 
AD G 


V D D 
D V X 
D V V 


F XV 
X F X 
X FD 
F D D 
D F F 
D F V 
V V D 
V VD 
V VD 
VF 
F V 
F V 


FIG17RE 54. 


( 6) 


.!!...!....l 
ADD 
AD F 
A AF 
F G G 
DD D 
I 
~·· 
' ,. 


AG X 
D X D 
A AV 
DVD 
XGA 
VDD 
VG A 
A AV 
XDD 
FA A 
VF D 
A AD 
DX D 
D F G 
GA A 


(6) 


~ 
ADD 
AD F 
A AF 
F G G 
DD D 
X G G 
AG F 
X DD 
AAA 
VA A 
AG F 
XGG 
D FA 
AD X 
GDF 
AD F 
DVD 
XFV 
D FD 
V VD 
F V 
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i. Frequency distributious are now made. If combination 5-14-3 is correct for No.:~, it is 
also correct for No. 6. 
Hence, 1t single distribution is made of the bipartite pairs in rows 1, 3, 5, 
... of columns 5-14, and of the pairs in rows 2, 4, 6, ... of columns 14-3. Similar distribu- 
tions are made of the pairs given under en.ch of the other combinations. These distributions arc 
shown in figure 55. 


A 


D 


F 


G 
v 
x 


(l) [5-14-:~] 


A D F G V X 


lHl 
Ill 
I 
II 
I 


- 
- 
-- - 
- 
- 
II 
Ill 
I 
I 


- 
- 
- 
- 
- 
,_ 


lHl 
,..._.. - 
- 
- 
- 
- 
II 
I 


- 
- 
- 
- 
- 
- 
/Ill 
II 
I 


- 
- 
- 
- 
- 
- 


Ill 
II 
II 


(4) [14-5-3] 


A D F 
G V X 


1HI 
Ill/ 
Ill 


- 
- 
·-- 
- 
-· 


II 
"II 
/Ill 
I 
,_ - 
- 
- 
- 
- 


I 
I 
II 
- 
- 
- 
- 
- 
- 


1HI 
I 
II 
- 
- 
- 
- 
- 
- 
II 
- 
- 
- 
- 
- 
- 


I 


(2) [5-14--4] 


A D F 
G V X 


l1f 
Ill 
I 
I 
I 
- 
··--- - 
- 
-- 
II 
/I 
II 
I 
-- ·-- - 
- 
- 
- 
II 
Ill 
-·· ·----- 
- 
- 


Ill 


- 
--- - 
- 
- 
1- 


Ill 
Ill 
I 
- 
- 
- 
- 
- 
-- 


Ill 
I 
II 
I 


(5) [14-5--4] 


A D F 
G V X 


A'ljl 
Ill 
II 


D 
·I 
Ill/ 
Ill 
II 
II 
II 


F 


GI/ 
II 
II 
v 
II 
x 


FIG11RJ: lil5. 


(3) [5-14-7] 


A D F 
G V X 


A lHl 
Ill/ 
ff 


D 
II 
Ill 
----·----·- 


F 
l'I 
II 
---------- 
G Ill 


V 
II 
1111 
----··· ---- 
x 
Ill 
II 


(6) [14-5-7] 


A D F G V X 


A "/I 
II 
II 


D 


F 


G 
II 
v 
x 


Ill/ 
ll/1 


Ill/ 


II 


II 
II 


II 


j. These distributions are now tested for monoalphabeticity, by applying the q, test. The 
number of occurrences in each distribution is 41. Then 41X40X.0667=109.4 is the expected 
value of q, for plain text; 41X40X.0385=63.1 is the expected value of tf> for random text. 
Here are the calculations for the first distribution (combination 5-14-3) yielding the observed 
value of q,as82: 


(5X4)+ (3X2) + (1 XO)+ (2X 1)+ (1 XO)+ 


(2X 1) + (3X2)+(1 XO)+ (1 XO)+ (5X4) + (2Xl) + 
(1 XO)+ (4X3) + (2Xl)+ (1 XO)+ (3X2) + (2X2)+ (2X1)=82. 


The observed v1tlues of q, for all 6 frequency distributions are shown herewith: 


(1)=82 
(4)=120 


(2)=76 (5)= 70 
(:-1)=78 
(6)=110 


'. 
'. 


I ! ' 


j 
! ·' 


? . I 
j ! l I 
! : 
l 


I 
. I 
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Only two of these distributions give close approximations to 109, the expected value oft/>, and 
they may be retained for further experiment. They are the ones for combinations (4) and (6), 
with values of 120 and 110, respectively. 
k. Selecting combinations (4) and (6) viz, 14-5-3, and 14-5-7, since columns 14, 3, 4, 5 and 
7 form the group of 5 columns at the left of the transposition rectangle, the following combina- 
tions are possible: 


(1) 
14-5-3-4-7 
(3) 
14-5-7-3-4 
(2) 
14-5-3-7-4 
(4) 
14-5-7-4-3 


l. The following sets of columns correspond to these 4 combinations in the 2 cryptograms 
(fig. 56): 
No. 3 


(1) 
(2) 
(3) 
(4) 


1411347 
14 
5 
3 
7 
4 
14 
ll 
7 
3 
4 
14 
5 
7 
4 
3 
1 
A D D F D 
ADD D F 
A D D D F 
ADD FD 
2 
ADV D F 
ADV FD 
AD F VD 
AD FD V 


3 
A AF X F 
A AF F X 
A AF F X 
A AF X F 
4 
F GD AG 
F GD GA 
F G G D A 
F G GAD 
5 DDFXD 
DDFDX 
DDDFX 
DDDXF 
6 
AGXVX 
AG XX V 
AG XX V 
AG XV X 
7 
DX A AD 
DX AD A 
DX DA A 
DX DA A 
8 
A AG D V 
A AG VD 
A AVG D 
A AV D G 
9 
D VF X D 
D VF DX 
DVD F X 
DVD X F 


10 
X G X FA 
X G X AF 
X GA X F 
XGAFX 
11 
VD AX D 
VD AD X 
VD DAX 
VD DX A 
12 
VG FF A 
VG FA F 
V G A F F 
VG AF F 
13 
A A ADV 
A A AV D 
A AV AD 
A AV DA 
14 
X D F GD 
X D FD G 
X DD F G 
X DD G F 
15 FAAAA 
FAAAA 
FAAAA 
FAAAA 
16 VF X GD 
VF X D G 
VF DX G 
VF D G X 
17 
A AD FD 
A ADD F 
A A D D F 
A AD FD 
18 DXDGD 
DXDDG 
DXDDG 
DX D GD 
19 
D F D G G 
D F D G G 
D F GD G 
D F G GD 


20 
GAD A A 
GAD A A 
GA AD A 
GA A AD 


FIOUBB M. 


(1) 


14 
5 
3 
4 
7 
1 A D D F D 
2 A D V D F 
3 A A F X F 
4 F G D A G 
5 D D F X D 
6 X G D G G 
7 A G F A F 
8 X D F X D 
9 
A A D F A 


10 V A D F A 
11 
AGFVF 


12 
X G D D G 
13 
D F D V A 
14 
A D F A X 
15 
G D X F F 
16 
A D F G F 
17 
D V XV D 
18 
X F X D V 


19 D F F V D 
20 V V D D D 
21 
F V 


115 


No. 6 


(2) 


14 
5 
3 
7 
4 


A D D D F 
ADV FD 
A AF F X 
F G D G A 
D D F D X 
X G D G G 
A G F F A 
X D FD X 
A AD AF 
VADA F 
A G F F V 
X GD GD 
D F D A V 
AD F X A 
G D X F F 
A D F F G 
D V X D V 
X F X V D 
D F F D V 
V V D D D 
F V 


(3) 


145734 
A D D D F 
A D F V D 
A A F F X 
F G GD A 
D D D F X 
X G G D G 
A G F F A 
X D D F X 
A A A D F 
VA AD F 
A G F F V 
X G G D D 
D FAD V 
A D X F A 
G D F X F 
A D F F G 
DVD XV 
X F V X D 
D F D F V 
V VD DD 
F V 


(4) 


14 
5 
7 
4 
3 
ADD FD 
AD FD V 
A AF X F 
F G GAD 
DD DX F 
X G G GD 
AG FA F 
X DD X F 
A A AF D 
VA AF D 
A G F V F 
X G GD D 
D F A V D 
AD X AF 
GDF F X 
AD F G F 
DVD V X 
X F VD X 
D FD VF 
V V D D D 
F V 


FIGURE M-C'ontlnued. 


m. The additional bipartite pairs given by adding columns 4-7 to the basic combination 
14-5-3 are distributed in the 4th frequency distribution square of figure 55, yielding the distri- 
bution shown in square (1) of figure 57. The other squares in figure 57 are constructed in the 
same way, for the other combinations of figure 56. 


A 


D 


F 


G 
v 
x 


(1) [14-5-3-4-7] 


A D F G V X 


'If! 
11{.J 
11{.J 
II 
- 
- 
w 


- 
- 
- 


Ill 
II 
'111 
I 


- 


11{.J 
Ill 
'111 
- 
- 
- 
- 
- 
,_ 


'J1f 
II 
I 
II 


'-- - 
- 
- 
- 
- 
II 
I 


'-- - 
- 
- 
- 
- 
II 
I 
I 


(2) [14-5-3-7-4] 


A D F 
G V X 


'111 
llf 
Ill 
Ill 
I 
- 
- 
- -- - 
- 
II 
llf 
'111 
Ill/ 
111: 
II 
,.___ - 
- ·-- 
- 
I 
l1f' 
/Ill 
I 
I 
II 


- 
- 
- 
- 
- 
- 


II 
llf 
I 
I 
II 


- 
~1-·- 


- 
- 


'------;-,-,---,-, - 
I 


FIGURE fi7. 


; 
1 


i i - 
I 
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(3) [14-5-7-3-4] 
(4) [14-5-7-4-3) 


A D F G V X 
A D F G V X 


'/If 
/Ill 
II 
I 
'/If 
Tiii 
II 
II 
II 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 


Tiii 
'!//, 'l!/u 
II 
II 
Ill 
I 
'If' 
'!//, 
I 
'If' 
11/1 
- 
- 
- 
- 
- 
- 
- 
- 
-- - 
- 
- 
II 
I 
Tiii 
II 
II 
II 
II 
II 
II 
Ill 
Ill 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
II 
Ill 
Ill/ 
I 
II 
Ill 
II 
Tiii 
II 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 


I 
Ill/ 
Ill 
I 
t--- - -, I-, - 
- 
II 
I 


--- - 
- 
- 
- 
- 


I 
I 


F1ouR11: 57-Continued. 


n. Again applying the .;-test, the expected value of q, is 81 XSOX.0667=432. The observed 
values for the four combinations of figure 57 are as follows: 


(1) For combination 14-5-3-4-7, q,=436 
(2) For combination 14-5-3-7-4, q,=276 
(3) For combination 14-5-7-3-4, <P=344 
(4) For combination 14-5-7-4-3, q,=318 


The combination 14-5-3-4-7, giving the greatest value for q, (a little better than the expected 
value), is very probably the correct one. 


o. Examining the other cryptograms that are available, it is seen that No. 7 is the third 
longest one of the entire set, with 124 letters; moreover, the dimensions of the rectangle [(15X9)- 
11=124] are such as to bring about 4 long columns of 9 letters and 11 columns of 8 letters. The 
first 5 columns are definitely fixed in position, since it is known that the first 5 key numbers a.re 
14-5-3-4-7. The resulting diagram is shown in figure 58. There is now a section consisting of 


14 
5 
3 
4 
7 
2 
a 
s 
9 
ro 
u 
~ 
u 
u 


A x 
D v 
D IA 
D 
F ~I~~~ 


D 
A 
G 
- 
I- 
,_ __ 
- 
D 
A 
G 
D 
F 
G 
F 
F ~_I~~~ A 
A 
D 


t--- 
-- 
- 
A 
A 
D v A F 
D A vlA 
G 
D 
F 
D 
G 


t--- 
-- 
P.--IFoA 
- 
x 
D 
F x 
D 
G 
D x 
F x v 
-- 
----- 
- 
G 
D 
A A D v 
F 
D x x v 
D v 
F x 


t---- 
- 
- 
- 
- 
- 
- 
---- 
- 
--- 
- 
- 
x F x 
D 
F 
D x 
D 
A 
D 
G 
F 
D x 
D 
,___ 
- 
A A v 
D 
D 
D 
F 
G x 
D 
F 
A 
G 
G 
D 
- 
- 
- 
- 
- --- 
- 
- 
- 
- 
- 
- 
~ 
- 


G 
G 
D 
A 
G 
D 
D x F 
G 
F 
D x v v 
- 
- 
A 
G 
D x 


}o'JGURll 58. 


:.· 


:~~:· 
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10 columns which are to be anagrammed to ascertain their correct sequence. The column to 
follow column 7 is ascertained on the ha.sis of the repetitions which are brought a.bout when the 
selected column is placed on the right. These repetitions should fall into those cells of frequency 
distribution (1), figure 57, which are of high frequency. In other words, the process is one of 
selecting from among columns 1, 2, 6, 8, 9, 10, 11, 12, 13, and 15 that column which will yield 
the most repetitions of bipartite digraphs with the digraphs given by the juxtaposition of columns 
l4-5-3-4-7, as distributed in frequency square (1) of figure 57. The column thus selected turns 
out to be No. 10. Then other columns are added by proceeding a.long the same lines, the work 
becoming progressively more easy as the number of available candidates decreases. Sometimes 
the discovery of what appears to be a. long repetition within one of the cryptograms or between 
two cryptograms facilitates the process. In this ·case the results obtained from the 3 crypto- 
grams under study are shown in figure 59. 


H 
Ii 


AD 
AD 
AA 
F G 
DD 
AG 
DX 
AA 
DV 
XG 
VD 
VG 
AA 
XD 
FA 
VF 
AA 
DX 
DF 
GA 


a 4 


D F 
VD 
FX 
DA 
FX 
xv 
AA 
GD 
FX 
XF 
AX 
F F 
AD 
FG 
AA 
XG 
D F 
D G 
DG 
DA 


7 10 
DX 
FD 
F V 
GF 
D F 
XF 
D F 
VD 
DX 
AG 
DV 
AG 
VD 
DF 
AG 
DA 
DV 
DA 
GD 
A 


No. 3 


l& 12 
AA 
F G 
FA 
FF 
GD 
XG 
AX 
XA 
D F 
FA 
D F 
DX 
FX 
XG 
AG 
AA 
AG 
AA 
AA 
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13 
1 


F X 
FD 
AA 
AA 
FA 
DG 
G X 
AD 
GD 
AX 
F V 
VF 
XF 
DV 
GD 
G G 
FA 
GD 
DF 


2 
8 
DD 
XA 
AG 
AA 
AA 
GA 
DF 
F G 
AG 
DD 
GX 
AA 
F X 
D F 
AG 
DV 
GX 
VD 
GD 


6 9 
AG 
GD 
VD 
AF 
AA 
G F 
AA 
F G 
D V 
VA 
D F 
VG 
DX 
XG 
FV 
DD 
AD 
XA 
F X 


11 
A 
x 
D 
A 
F 
A 
A 
F 
D 
G 
F v 
F 
x x x 
A 
A 
G 
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No. 6 


14 s 
3 
4 
7 
10 
15 12 
13 
1 
2 
8 
6 
9 
11 


AD 
D F 
DX 
A A 
F X 
DD 
AG 
A 
' 


AD 
VD 
FD 
F G 
F D 
XA 
GD 
x 
'"(•. 


AA 
F X 
F V 
FA 
A A 
AG 
VD 
D 
F G 
DA 
G F 
F F 
AA 
A A 
AF 
A 


·: i 
DD 
F X 
D F 
GD 
F V 
D F 
XF 
F 
X G 
D G 
GX 
D G 
FD 
XA 
AD 
v 
. ! 
AG 
F A 
F V 
DD 
F X 
GD 
AG 
D 
Ii 
': 
XD 
F X 
DA 
A A 
DD 
GA 
GD 
x 


l 
i 
A A 
VG 
AV 


~ : . 
D F 
AX 
D V 
G V 
G 
l. 
VA 
D F 
D F 
AD 
XO 
x 
'!: 
AG 
DV 
AG 
F V 
FF 
DD 
FX 
GD 
G G 
F 
X G 
DD 
GD 
FD 
F V 
DD 
X G 
D 
D F 
D V 
A A 
AD 
AG 
FA 
DX 
A 
AD 
FA 
XG 
GD 
F D 
D V 
DA 
G 
GD 
X F 
F X 
DD 
DD 
AG 
DX 
A 
AD 
F G 
FF 
F F 
A A 
A A 
AA 
G 
D V 
xv 
D F 
AX 
G V 
AV 
DX 
A 
XF 
XD 
VF 
X G 
D G 
GA 
XO 
v 


J; 


D F 
F V 
D F 
DV 
GX 
AD 
FA 
D 
v v 
DD 
DA 
GA 
GA 
X F 
AD 
v 
F V 
I . 
No. 7 
I 
14 
5 
3 
4 
7 
10 
15 12 
13 
1 
2 
8 
6 
9 
11 


AX 
D V 
D F 
GD 
AA 
DD 
F X 
G 
DA 
GD 
F X 
DA 
AG 
F D 
FD 
x 
A A 
DV 
AG 
G F 
D F 
DV 
A A 
D 
XD 
F X 
DD 
VF 
XG 
DA 
X F 
A 
GD 
A A 
D V 
xv 
F V 
FX 
DX 
D 
X F 
X D 
F G 
DD 
XO 
XA 
DO 
F 
AA 
VD 
D F 
D G 
GD 
F X 
GD 
A 
G G 
DA 
G F 
vx 
VD 
D F 
X G 
D 
AG 
DX 


jf 


Fmt1B11: 119-Contlnued, 


p. What the cryptanalyst now has before hitn is a monoalphabctic substitution cipher, the 
solution of which presents no difficulties. The cipher square is reconstructed as completely as 
possible, blanks being left where there are no occurrences to give clues as to the character involved, 
usually some of the digits and the very infrequent letters. In this case the only letters which do 
not occur in the plain text are Q, X, and Z. 
The digits 5 and 7 are recovered from the context, 


' 
in message No. 6, where the caliber of a gun is mentioned and the digits are confirmed at other 
places in the message. The square that is obtained is seen in figure 60. Examination of the 
mixed sequence discloses that it is based upon the phrase THE FLOWERS THAT BLOOM IN THE 
SPRING. This permits of the establishment of the transposition key and of the position of the 
digits in the checkerboard (as in par. 381). 
Th<' results are shown in figure 61. The completely 
solved rnessa.ges are shown in figure 62. 
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40. Special solution by the exact factor method.-a. The student who has comprehended 
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latter is based upon the interception of a number of cryptograms, preferably lengthy ones, which 
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have been enciphered by rectangles in which the last row is completely filled with letters. The 
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dimensions of the transposition rectangle. Then the text is transcribed into columns of appro- 
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priate length, all being equal in this respect, and the process of combining columns, as explained 
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digraphs down the juxtaposed columns. There is nothing to prevent the simultaneous use of 
all cryptograms that have been enciphered by completely filled rectangles, for it is clear that 
if, for example, columns 15 and 4 are to be paired in one cryptogram, the same columns will be 
paired in all the other cryptograms. Hence, even if the rectangles are small in depth they can 
be used in this process; it is necessary only that all columns of any rectangle be of the same 
length. Now if only two or three such pairs ofcolumns can be set up correctly, solution follows 
almost as a matter of course. No additional or new principles need be brought into play, beyond 
those already possessed by the student. 
b. In this special solution, the important step is, of course, the initial one of experimenting 
with rectangles of various dimensions until the correct size has been hit upon. In some cases, 
excessive experimentation may not be necessary if the total number of characters is such as to 
yield only one or two possibilities with regard to the length of the columns. For example, suppose 
that previous work has established the fact that the enemy uses transposition rectangles not 
less than 15 and not more than 22 columns in width. A message totaling 703 letters would 
indicate a rectangle of 19 columns of 37 letters, since these two numbers are the only factors of 
703. If this then were corroborated by other cryptograms of 76 (19X4), 152 {19X8), 190 
(19X 10) letters, the probability that 19 is the width of the transposition rectangle becomes quite 
persuasive. Of course, there will be and there should be other cryptograms of lengths that do 
not factor exactly; these represent the ones in which the rectangles are not completely filled in 
their last row. They do not enter into the solution at first, but just as soon as the positions of 
two or three key numbers become fixed, the data afforded by these messages become available 
for use in the later stages in the solution. 
c. The exact-factor method is a useful one to know. }'or despite all instructions that 
may be drawn up in~isting upon the advisability of not completing the last row of a transposition 
rectangle, the tendency to violate such a rule is quite marked, especially where a large crypto- 
graphic personnel must be employed. It is not astonishing to find that for lazy or ignorant clerks 
the temptation to fill the rectangle completely is particularly hard to resist when it happens that 
a message falls just one, two, or three letters short of forming a completely-filled rectangle: 
it is so much easier for such clerks to handle a rectangle with equal-length columns than one in 
which this is not the case. Moreover, the number of errors and therefore the number of times a 
shiftless or careless clerk must go over his work to correct errors is reduced to a minimum. 
Hence, it often happens that in such cases an enciphering clerk adds one, two, or three letters 
to complete the last row, thus leading to the transmission of not a few cryptograms enciphered 
by completely-filled rectangles. Space forbids giving an example of such a solution. 
41. General solution for the ADFGVX system.--a. All three of the foregoing methods of 
solving cryptograms in the ADFGVX system fall in the category of special solutions and therefore 
are dependent upon the fortuitous existence of the special conditions required under each case. 
What is really desired in the practical situation is a method of solution which is not so dependent 
upon chance or good fortune for success. A search for a general solution was, of course, made 
during the time that the system was under minute study by the cryptanalytic agencies of the 
Allies, but no general solution was devised. All the solutions made during actual hostilities 
and for a number of weeks thereafter were of the special types described in the preceding para- 
graphs. The first published description of a general solution is to be found in Giviergc's Oours 
de Cryptographie, 1925, but only in broad outlines. A complete general solution was inde- 
pendently conceived by a group of cryptanalysts in the office of the Chief Signal Officer 6 and 
will be described in paragraphs 42 and 43. 
b. The attention of the student is directed to the comments made in paragraph 18, with 
regard to the significance of the term general solution in cryptanalysis. He must be cautioned 


• See footnote 7 of this section. 
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not to expect that in practical work a general solution will, in the cryptanalytic as in the mathe- 
matical field, invariably lead to a solution. If there is a sufficient amount of text and if the text 
contains no abnormalities, the attempt to apply the general solution will usually be successful. 
But the cryptanalyst must remember that the ADFGVX system is by no means a simple one to 
solve even under the best of conditions and if there is only a small amount of text, if it happens 
that the transposition key is unusually long, or if the text is abnormal, he may not succeed in 
solving the messages by the straightforward method to be set forth below, and he may have to 
introduce special modifications. For the latter he can only rely upon his own ingenuity and 
intuition. 


42. Basic principles of the general solution.-a. Every transposition rectangle in the 


ADFGVX system must conform to one or the other of two and only two fundamental types: the 
number of columns must be either odd or even. A number of important consequences follow from 
this simple fact, some of which have already been pointed out in paragraph 39e. They will be 
elaborated upon in the next subparagraphs. 
b. Consider a rectangle with an even number of columns. Each of its rows contains an 


even number of bipartite components, half of which are initial components, half, final compo- 
nents, alternating in a regular order from left to right in the rows. When the transposition is 
applied, all the components within a given column are of the same class, either initial or final. 
No interm.ixture or alternation of the two classes is possible. On the other hand, consider a 
rectangle with an odd number of columns. Ea.ch of its rows contains an odd number of bipartite 
components, the 1st row containing one more initial component than final components, the 2d 
row containing one more final component than initial components, and so on, this arrangement 
alternating regularly in the successive rows of the rectangle. When one studies the various 
columns of the rectangle, it is seen that in each column there is a perfectly regular alternation of 
initial and final components, the odd columns (1st, 3d, 5th, . . . ) beginning with an initial 
component, the even columns (2d, 4th, 6th, . . . ) beginning with a final component. This 
alternation in components remains true even after the transposition is applied. These remarks 
become very clear if one studies figure 63. Two transposition rectangles are shown, one with 
an even number of columns, the other with an odd number. Instead of the actual components 
(ADFGVX), the symbols 9 1 and 92 are used to indicate the two classes of components, initial and 
final, because in this analysis interest centers not upon the actual identity of a component but 
upon the class to which it belongs, initial or final. At the top of each column is placed a "plus" 
to denote a column occupying an odd-numbered position in the rectangle, or a "minus" to denote 
a column occupying an even-numbered position. 
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c. In what follows, the term "odd column" will mean merely that the .column in question 
occupies an odd position (1st, 3d1 5th, . . .) in the transposition rectangle; the term "even 
column," that it occupies an even position (2d, 4th, 6th, ... ) in the rectangle. The odd or 
even designation has no reference whatever to the nature of the transposition key number appli- 
cable to that column, whether it is odd or even. Now when the transposition is applied to the 
even-width rectangle a, figure 63, the cryptographic text will consist of a number of sections of 
letters, ea.ch section corresponding to a column of the rectangle, and therefore the number of 


3241115-41-9 


i 
l ! 
! ! 


·: 


126 


sections in this case will be even. 
Moreover, all the components in a section corresponding to 
an odd column in rectangle a will be 01 or initial components, all those in a section corresponding to 
an even column, 02 or final components. The sections or columns are completely homogeneous with 
respect to the class to which their constituent components belong. On the other hand, when the 
transposition is applied to odd-width rectangle b, the cryptographic text will consist of an odd 
number of sections, each corresponding to a column of the rectangle. The components in the 
sections consist of members of both classes of components in a regular alternation; in a section 
corresponding to an odd column the order is Oi-~02--+0 1 • • . ; in a section corresponding to an 
even column the order is 02--+81 --+02 • . •• The sections or columns are not homogeneous in this 
case as they are in the former. 
d. Now if there were some way of distinguishing between initial components as a class and 
final components as a class it is clear that it may be possible first of all to ascertain whether the 
transposition rectangle contains an even or an odd number of columns. Secondly it may be 
possible to identify those columns which are even and those which are odd. Finally, it may be 
possible to ascertain which are the long columns and which are short, thus yielding the exact 
outlines of the rectangle in case the last row is incompletely filled. From that point on, solution 
follows along the same lines as explained in paragraph 40, with the modification that in the pair- 
. ing of columns the number of possibilities is greatly reduced, since it is useless to pair two columns 
both containing initial components or final components. 
e. The foregoing depends then upon the possibility of being able to distinguish as a class 


between initial and final components of the bipartite cipher equivalents in this system, or at 
least between letters belonging to one or the other of these two general classes of components. 
Now if the substitution checkerboard has not been consciously manipulated with a view to 
destroying certain properties norm.ally characterizing its rows and columns, the sort of differenti- 
ation indicated above is quite possible. For example, if in the checkerboard shown in figure 61 
the normal frequencies of the letters as they appear in English telegraphic plain text 8 are inserted 
in the cells and totals are obtained vertically and horizontally, these totals will permit of assign- 
ing frequency weights to the letters ADFGVX as initial and as final letters of the bipartite cipher 
equivalents of the plain-text letters. This is shown below in figure 64. The bipartite letter A 
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FIGURE 64. 
•As given in fig. 3, p. 13, Military Cryptanalyaia, Part 1. 
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has a frequency value of 284 as an initial component of the bipartite cipher equivalents of plain- 
text letters, and a frequency value of only 169 as a final component. 
Similarly, the letters V and X have frequency values of 47 and 69, respectively, as initial com- 
ponents and 120 and 198 as final components. It is obvious, then, that in this checkerboard the 
weighted frequency values of the letters A, V, and X as initial components differ considerably from 
the values of these same letters as final components, the value for G as an initial is only a little 
less than its value as a final, the values of D and F as initials are only a little more than their 
values as finals. But it is the wide variations in the weighted frequency values of certain of the 
letters as initial components and as final components, exemplified in the case of A, V, and X, 
which form the basis of the general solution, because these wide variations afford a means for 
making the various differentiations noted in subparagraph d. 
f. Of course, in working with an unknown example, the composition of the checkerboard is 
unknown and therefore no accurate frequency weights may be assigned to the ADFGVX com- 
ponents in the cryptograms. However, it is still possible to arrive at some approximations for 
these weights in case there are several cryptograms available for study, as would norm.ally be 
true in actual practice. How this can be done will be shown very soon, by studying an example. 
For the purposes of this study the set of 12 cryptograms given below will be used. 


I 


VD D G G 
G VF D F 
V D V V F 
VD GAD DA FF F 


VD X FD DXDVX A D V D V 
F X GDF VA DD G 
D GD G V 
GD DD F 
X FAD A 
VD VG D GAD XV 


DAD AD 
F X AV F 
VD DA A 
VD FF D 
F VG D F 


VD D G V 
DD DD A VADA F 
ADD X A 
DD GAD 
F VG F V 
D GAD V 
F XV X D 
GD DAG GD DX F 
FD DX A 
D F GD A 
G X DD A 
V F D A F 
G V F V F 
AF F VF AF X G F 
XDGVA D F VD G GAV G G 
DD GD V 
X AX FD DX 
(212 letters) 


II 


VD A AV DD F X F 
X DD AX 
G X F X D 
D F X AD 


VAGDD FAX D V AVDVD D F VF V FF GD G 
F VAX V 
X AVG D 
VD X FD 
X D GA X 
G F G G F 


V F G D F 
VD X AV 
X DD VG DD VG V 
AG F X F 
AAAXD DXG {108 letters) 


III 


DAGAA FGAGV DA F G G XFDXD F V V X G 
F X FD X 
DD AG A 
DD G VA DD VD D GAF GA 


VGDGX DD DAV F VD D F 
DA A A A DX AG D 
X AG GD DAV G V 
F G D V F 
VD G G X 
G GAFF 


VF DAX GD DD G DA FD A 
D G GAD D GD X A 
F VD FD 
X F VG D 
D VA VF D D D V F 
AG D FF 
F X A AD FAD G G VF DAV D G X F V 
DA AVG 


DX F G G DD X GD 
A 
(186 letters) 


128 
129 


IV 
IX 
i 
ADXVF XV G G V FD D VA F GA AV 
F D G V D 


.\(" 
GD DD D XV G VD VD AVG F GDF V 
D VA VD 


i . 
DD GD G FD V VA F G X F X FD DD D VGDAX 
I 
G FAG X 
AV FF G VA DD D AXXAX DGADG 
! 
DAX DD DAG VF FA ADV GDF X G 
X G VG D 


~; •··. 
XAVVD G XX A A 
AV AD A 
D G X D V 
GD DD D 
.· 
DD DAD V XV FA VD A XX D FA AF AV D VG 
G VF X A AVG G V 
F X D A F 
D G VG A 
F GD D F 


VD VD D AXDAA 
(110 letters) 
AV VG D DVD F X DVD G F 
VA AG D 
X FD VA 


I 
;:· 
AD AG D AX F VG DD DAG VA VF G XX FD D 
v 
G X F VD 
G GD AV DAGG F 
DAX DX F F V G F 
AX X AD 
D F 
(182 letters) 
D F X FD D V V VD XFXFX FF F VA G FD X A 
V D A G F 
DVD G F 
AD A AD FD VF G DAD F V 
x 
F VF X G 
X DD AG DVGVF D G XX D FF GD G 
X G VD D VD D F G 
F VG DD VF VA G XX D F V 
D GD D F 
VF AV D VF DAD G F VG V 
G GDF V 


DX AV F 
GAG AG AX DVD F X G VG DADD X 
D V V X D 
D FD D V 
G X G VD 
X G VG D 
X D GD X 
AG X DA D FD G X FD G G F 
VG XV V 
GD DD A 
FXFDX VD A AD 
D F X DD AF FA A 
F VF AG 


G XV D G VD VG X 
DD FD D VA GA A 
D GD D F 
DAAGG FAXGV XXFXA D GDF D 
G X GD A 


D GAG D FD DD D 
X G VG V 
G G GD G 
X D F G F 
DAX G V 
V VD A A 
G G VF G VA VF V AAGAX 
AD 
(202 letters) 
G X D G A (130 letters) 


VI 
XI 


GD G F X 
AG VF V 
DD X G X DVD DA XDAAX 
.V F D D V 
AX GD A 
D F G G G 
G F GD D FXXDA 
FAG VG DX FF V 
X FAD G FF DX A AF V X F 
FDDXG GAV GA GD VD F 
D FD DD 
G·A FA F 
D F X F V 
GD G F X FD V V X 
VG D F V 
DD VF D 
DA A AG VA VF G 
G VA DD GD D F G 
F VD DA 
·- 
. 
- 
-· 
·- 
. 


I 
F V VD V 
D G G VF 
X F G V X FF VG V 
DD GD D 
D F GAF D F VD D 
F V V VA DAGDX FXXXF 
DD GD D AVG V X GAFF X 
F V D D D (120 letters) 
FD X GD FD G FD D F GD A 
G FA AG GAD X D 


GVDGA VG VD F 
DD F X G AG X F G VF V VD 
VII 
GVDXD FF F X G XGXAG AG VG D 
V V X G .F 


GAF G F 
F X F VF G F X AV AG G X D XX DD F 
VDXDD XFVDD X (186 letters) 


AG VD D 
V D V F F 
AD AV A VF VG G AD A AF 
XII 


V F D F V DXFXX GD X DD 
F V D F F 
X D VF X 


VA DX V AXDVX AF F VD FD G X F 
D G F D D 
XFDFX V VD VD AV DAD V F A G D 
G VA DD 
F VD V V 
A AF VF 
F V X D G FD D VA D D F D D 
FD A AD 
X AD F V 
G VD G F 
X F GD V 
F VD DD 
DX FF A 
G F X F X 
A AG VD 
G G VD F 
G G G X D 
D GD V V 
AV V VF ADDAX AV F VA DAX D V 


FD F VA FF G F X 
GD AX D 
GD G GD DAV DX 
GD D FA XDDGX G VF X A 
V XV FD GD X D F 


·' 
AD FA F 
VF X DD XV AG D 
V VD D F 
XDGXX 
DVXAD VA VA V 
G VD DD AF D FA D VF F V 


D V F V F 
DD DD A AF D F X 
DX GD A 
A F V D F 
VGDAG F X DD F 
ADV XV 
D F X FF V VG F X 
D V D D V ADD VD VA VD G 
A F V F X FA AV D 
XGFVA VF AG G DAV VD XDXGD D V VA D 
D F VD 
(254 letters) 
DD AG A 
AG X F G DD D G V 
F G F VG 
V X G VF 
VIII 
D FF DA 
A D V D D 
X GDF D DVD D G 
A F G D 
(224 letters) 
D G V VG F X G G G AD FA F 
VVVAX AVG G V 
VD VG V 
VD AVG D GD GA VF DD A 
DD DX X 
43. mustra.tion of solution.7-a. Since the initial letters of all 12 cryptograms are in the 
DX F VF X G VG G 
D GDF G GD AD F 
DD X AV 
same class, that is, either initial or final components, they may all be combined into a single 
F D D V F 
AD X GD AD G VA FF X AD FAD X D 
distribution. Furthermore, since it is certain that regardless of whether the transposition rectangle 
G F A D F 
DD G VD 
V X AV A 
DD X FF AG DX F 
has an odd or an even number of columns the 3d, 5th, 7th . . . letters of the cryptograms are in 
F V F G F 
G F D F D VD XX D 
D G GD 
(144 letters) 
' This illustration uses the same cryptograms and follows quite closely along the lines employed in a tech- 


i: 
nical paper of the Signal Intelligence Service entitle<t Qeneral Solution for thB ADFGVX CiphBr, prepared by 
Messrs. Rowlett, Kullback, and Sinkov, in 1934. 
'· 
'1 
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the same class as the first letter, the 3d, 5th, 7th ... letters may be added to the distribution, 
so long as these odd letters come from the same section (column 1). It is,_ however, necessary 
to limit the number of letters taken from the beginning of any one cryptogram to a reasonable 
length of column, depending on the size of the cryptogram. Assuming it is known that the 
enemy is using transposition keys of not less than 15 nor more than 22 numbers, the latter could 
be taken as the maximum possible size. But to be on the safe side it will be here assumed that 
a transposition rectangle of not more than 25 columns is being used. Hence, so far as concerns 
cryptogram I, which has 212 letters, on the basis of a key of 25 numbers [(25X9)-13=212] 
there will be 12 columns of 9 letters and 13 columns of 8 letters. Since there is no way of telling 
which are long and which are short columns, it will be safer to work on the basis of columns of 
8 letters. Therefore, the first 8 letters of cryptogram I are to be taken. In the case of crypto- 
gram II, with 108 letters, its first 4 letters will be taken, and so on, through the 12 cryptograms, 
the number of letters to be taken in each case being governed by the length of the cryptogram. 
The sections taken in the case of the 12 cryptograms are shown in figure 65. 


Cryptogram 
Length 
Letters taken 
Cryptogram 
Length 
Letters taken 


I 
212 
VDDGGGVF 
VII 
254 
GAFGFFXFVF 
II 
108 
VDAA 
VIII 
144 
DGVVG 


III 
186 
DAGAAFG 
IX 
182 
GDDDDXV 


IV 
110 
ADXV 
x 
130 
DGDDF 
v 
202 
DFXFDDVV 
XI 
186 
VFDDVAX 


VI 
120 
GDGF 
XII 
224 
XFDFXVVD 


FIGl1BE 65. 


b. The odd and the even letters of these 12 sections are then distributed separately, the 
results being shown in figures 66 and 67. A consideration of the mechanics of this system leads 
to the expectation that if the transposition rectangle has an even number of column& the two distri- 
butions will be simil.ar; if it has an odd number, they will be dijjerent. 
The similarity or difference 
between the two distributions is usually discernible with as few as 20 or 25 letters. 


Odd (1st, 3d, ... ) letters 
A D 


Ill 'P 


F G V X 
Ill 
lHJ 
'It/, 
/'HJ 
111 
; 
r 


FIGUBB 66. 


Even (2d, 4th, . . .) letters 
A D F G V X 


lHJ 
'I/Ii 'I/Ii 
lHJ 
Ill/ 
I 
I 


FIGUBB 67. 


c. Letters V and X are of high frequency in the odd positions (fig. 66) but of low frequency 
in the even positions (fig. 67), whereas the letter Fis of low frequency in the odd positions and of 
high frequency in the even positions. There can be no question that the two distributions are 
dissimilar, and the indications are clear tha.t the transposition rectangle involves an odd number 
of columns. 
d. Now the letters in figure 66 may be initial components, those in figure 67, final com- 
ponents, or the reverse may be the case. At the present stage of the study it is impossible to 
ascertain which of these alternative hypotheses is correct. However, this information is really 
immaterial at this stage. Suppose the letters in figure 66 are arbitrarily designated as class 1 
components, those in figure 67 as class 2 components. Class 1 components (fig. 66) are charac- 
terized by a predominance of V's and X's (over their frequencies in fig. 67); class 2 components 
(fig. 67) are characterized by a predominance of F's (over its frequency in fig. 66). 
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e. The two distributions in figures 66 and 67 apply to the letters which come from columil I 
of the transposition rectangles for the 12 cryptograms understudy. In this column, the V's and 
X's fall predominantly in the odd positions, the F's fall predominantly in the even positions. 
Therefore, beginning with position 1, the components in this column show an alternation of the 
type 9c~ 92~ 01• 
By referring to figure 63 it will become clear that if class 1 components are 
initial components, then it must follow that column 1 occupies an odd position in the transpo- 
sition rectangle; but if class 1 components are final components, then it must follow that column 
1 occupies an even position in the transposition rectangle. Which of these alternatives is true 
cannot be ascertained at the moment. But the important point to be noted is that a definite reversal 
in the type of alternation of class 1 and cl,ass 2 components indicates the transit, in the transposition, 
from the end of one column to the beginning of the next column. That is, if it is found that from the 
beginning of the cryptogram the alternation of components is 01~ 
02~ 01 and after a number 
of letters this alternation changes to 02~ 01~ 92, the point where this change occurs marks the 
end of column 1 and the beginning of the column 2. For the sake of brevity in reference, in the 
subsequent paragraphs the type of alternation 01~ 
02~ 9 1 will be designated as the"+ type," 
and this type of alternation characterizes columns which fall in the odd positions in the trans- 
position rectangle i. e., in the 1 at, 34, 5th, 7th, ... positions from the left. The other type, 


0ll~01~02 will be designated as the" - 
type," and this type of alternation characterizes columns 
which fall in the even positions in the transposition rectangle i. e., in the 24, 4th, 6tb, 8th, ... 
positions from the left. 
f. With these principles in mind, let cryptograms III and XI, each containing 186 letters, be 
studied. They may be superimposed, since they have identical numbers of letters and therefore 
the columns end at exactly the same points in both cryptograms. 


2 
3 
4 
Ii 
6 
7 
8 
g 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
III. D A 
XI. V F 
G A 
D D 
A F 
V A 
G A 
X G 
G 
D 
v 
A 


III. X G F 
X F 
D X D D A 
XI. D A F 
D D X G G A V 


D 
D 
A 
F 


G A 
G A 


F 
G 


D 
G 


G G X 
G G G 


D 
D 
G V 
V D 


F 
F 


A 
F 


D X D 
G D D 
F 
F 


D 
D 
D 
F 


V D 
D D 


v v 
x x 


D G 
D G 


47 
48 
49 
50 
111 
52 
53 
54 
55 
ll6 
57 
li8 
59 
60 
61 
62 
6.1 
64 
65 
66 
67 
68 
69 
III. A F G A V 
XI. A F 
A F 
D 
G D 
A A 
G X D D D 
A 
G V 
A 
V 


70 
71 
72 
73 
74 
75 
76 
77 
78 
79 
80 
81 


A 
F v 
G 
F V 
G V 


D 
A 
D 
D 
F 
D 
D A 
A 
A 
G D D F 


Ill. A D X A 
XI. G 
F 
V 
D 
G D X A 
G G D D 
D A D F 
G A F 
D 
A V G V F 
G D V F 
V D 
F 
V D D F 
V V V A 
D A 


111.G G X 
G GAFF V 


XI. G D X F 
X X X F 
F 
F D 
D X 
A X 
G D 
G 
F 
D 
D 
D D 
G F 
G 
D 
D 
D 
A 
F 
F 
G 
D 
D 
A 
A 
116 
117 
118 
119 
120 
121 
122 
123 
124 
125 
126 
127 
128 
129 
130 
131 
132 
133 
134 
135 
136 
137 
138 
III. D G G A D D G D X A 
XI. G F 
A 
A 
G G A 
D X D 


III. V F D 
XI. X G A 


111. F D A V D 
XI. G X A G A 


1!!..,.!! 


III. D A 
XI. D X 


G X F 
G V G 
v 
D 
D 
v 


F V D 
G V D 


A v 
A 
x 
v 
G 


F D X F V 
G A 
V 
G V 


G D 
D F 
D 
D 


G D 
F V 
X F 
D X 
G G D D 
D D X F 


V A 
D F 


x v 
G 
D 


132 


g. It has already.been noted that beginning with the first letter of any one of the crypto- 


grams, the type of alternation for column 1 is +. It is therefore not astonishing to find, within 
the first 10 letters, an alternation of the + type. Note how the V's and X's fall in the odd posi- 
tions, the F's in the even. Thus: 
1 
2 
3 
4 
5 
6 
7 
8 
9 10 


Ill. D A G A A E G A G ! 
XI. !EDDY..A!GDA 


It is seen that there are 2 V's which fall in odd positions (1 and 5), but one V falls in an even 
position (10). There is an X, which falls in an odd position (7); there are 2 F's which fall in even 
positions (2 and 6). Unquestionably, then, the type of alternation, at least for the first 10 
letters in each of these cryptograms, is +. 


h. Take the next section of 10 letters in these two cryptograms. The letters are as follows: 
11 12 13 14 15 16 17 18 19 20 
III. DA[GG!ED!D 
XI. D E G G G G E G D D 
Here there are 4 F's; 3 of them fall in odd positions (13, 17, 17), and one falls in an even position 
(12). There are 2 X's; one falls in an odd position (19), one in an even position (16). 
There are no 


V's among these letters. So far as the evidence afforded by the F's is concerned, it would appear 
that this section of text shows the type 2 or" - 
type" of alternation of components, since in 
type 1 or "+ type" the F's occupy even positions and here the majority of them occupy odd 
positions. But so fe.r e.s the X's are concerned, the evidence is equally be.le.need: one X falls in an 
odd position, one in an even position. There being no V's, no conclusions can be drawn from this 
letter. To be guided solely by the evidence afforded by the 3 F's may be unwarranted. Is it 
not possible to weight the frequencies of the letters §O that it will be unnecessary to rely merely 
upon e. few of them and the evidence afforded by all the letters can be taken into account? Why 
not assign frequency weights according to the two distributions in figures 66 and 67? The figures 
then become e.s follows: 


Odd (let, 3d, • , .) letters 
A D F G V X 


:;:; 
i?i 
:;:; 
i?i 
i?i 
i?i 
~ 
~ 
~ ._ 


Even (2d, 4th, • . .) letters 
A D F G V X 


'r9tal-a + 11 + 3 + 8 + 11 + 6-42letters 


FIGURE 69. 
Total= 4 + 10 + 11 + 5 + 4 + 1 =35letters 


Since the odd letters have e. total frequency of 42, the even, e. total frequency of 35, for purposes 
of equalizing the distributions in applying the weights it seems advisable to deduct one-sixth 
from the total when applying the weights to odd letters. 
i. Now in applying these weights to the letters, it must be borne in mind that since e. trans- 


position rectangle with an odd number of columns is involved, half of the letters are class 1 com- 
ponents, the other half a.re class 2 components. Hence, in finding the frequency ve.lue of the 
letters it is necessary to apply the weighted frequencies to alternate letters in the sections, as 
shown in figure 70. 


III. 
XI. 
Distribution of odd letters 
A D F G V X 


,_ 0 
3 
3 
3 
0 


11 12 13 14 l/i 16 17 18 19 20 
DAFGGXFDXD 
DFGGGGFGDD 
Distribution of even letters 
A D F G V X 


,_ 1 
3 
• 
0 
'.!j'IGUU 70. 
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These distributions, when evaluated in accordance with figure 69, yield e. tote.I frequency value 
of 126; when eve.luated in e.ccorde.nce with figure 69 reversed, yield e. total frequency ve.lue of 
143. The detailed calculations a.re e.s follows: 


On the basis of figure 69 normal (odd letters as 01's, even letters as 02's): 
0(3) +3(11) +3(3) +3(8) +0(11)+ 1 (6)=72 
72 
72--=60 
6 


1(4)+3(10)+ 1(11)+4(5)+0(4) +1(1)=66 
=66 


Tote.1=126 
On the basis of figure 69 reversed (even letters e.s 01's, odd letters as 02's): 
1(3)+3(11)+1(3) +4(8)-f-0(11)+1(6)==77 


77-77 =64 
6 


0(4)-f-3(10)+3(11)-f-3(5)+ 0(4)+1(1) - 79 
. 79 


Total=143 
j. Now the frequency sums here obtained (126 vs. 143) indicate that an alternation of the 
type 02--+01-+02 is in effect, that is, if a beginning is ma.de with position 11, the type of alterna- 
tion is "-". Since the type of alternation for the first 10 letters is "+" and for the second 
10 letters "-", the reversal in alternation would indicate that column 1 of the transposition 
rectangle ends somewhere near the 10th letter. This so.me sort of reversal takes place after the 
20th letter, as shown by _the ciai~tilaiion in figure 71. 
· · ·' 
· · 


21. 22 23 24 25 26 
'Jf1 
2R 
~9 30 


III. FVVXGFXFDX. 
. 
-. 
XI. 
FXXDAFDDXG 


Distribution of odd letters 
A D F G V X 


Distribution of even letters 


A, 
D F G V X 


.._::::::::::::· ....... -:::: 
:::::. 
;:::: 
""' - 
:::::::: 
_-...; 
.• 
-... 


,_ 1 
3 
,_ 0 
2 
3 
1 
3 


On the basis of figure 69 normal (odd letters as 01's, even letters as 0 11's): 
. 
. 


1(3)-f-2(11)+ 2(3)+1(8)+1(11)+3(6)=68 
68 
68--=57 
.6 


0(4)-f-2(10)+3(11)+1(5)+ 1(4)+3(1)=65 
=65 


Tote.1=122 


On the basis of figure ~9 re.versed (even letters as 01's, odd letters as 011's): 
0(3)+2(11)+ 3(3)+ 1(8)-f-1(11)+3(6)=68 
. 
- - 68 . 
68--=57 
6 


1(4)+2(10)-f-2(11)+1(5)+ 1(4)+3(1)_::58 
=58 


Tote.1=115 


J!'IGtrIIE 71. 


.i I 


I' 


I 


i I : 
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Beginning with the 21st position, the alternation is of type 01-+02-+01; hence itisofthe" +"type. 
Again the reversal in type of alternation occurs in passing from the 2d set of 10 letters to the 3d 
set, and this indicates that column 2 of the transposition rectangle ends somewhere near the 20th 
letter. But, fortunately, this time the exact location of the break is definitely indicated: The 
simultaneous appearance of V and X in the sequent positions 22 and 23 leads to the idea that the 
22d letter marks the end of column 2 and the 23d letter marks the beginning of column 3. 
There is 


nothing of an absolute nature in this point: It is merely an indication based upon probabilities and 
does not constitute a conclusive proof by any means. Now if there is this definite break at the 
end of 22 letters it means that columns 1 and 2 must each contain 11 letters. The calculations 
have heretofore been based upon sections of 10 letters and the results a.re therefore modified as 
shown in the following calculation: 


FIRST SECTION (letters 1-11) 


1234567891011 


III. D A G A A F G A G V D 
XI. V F D D V A X G D A D 


Distribution of odd letters 
Distribution of even letters 


A D F G V X 


--~ 
;:::::::- 


A D F G V X 


~ - 
::::: 
.............. 


,_ 1 
6 
0 
3 
2 
,_ 6 
2 


Weighted values of distributions: 


On the basis of figure 69 normal (odd letters as 01's, even letters as 9-'s): 


1(3)+5(11)+ 0(3)+3(8)+2(11)+1(6)=110 110 


110--=92 
6 
5(4)+1(10)+2(11)+1(5)+ 1(4)+0(1)=61 
=61 


Total=153 


On the basis of figure 69 reversed (even letters as 91's, odd letters as 02's): 
5(3)+1(11)+ 2(3)+1(8)+1(11)+0(6)=51 51 
. 
51--= 42 
6 
1(4)+5(10)+0(11)+3(5)+ 2(4)+1(1)=78 
=78 


The type of alternation is 01-+92-+9i, or "+ ". 


SECOND SECTION (letters 12-22) 


12 13 H 15 16 17 18 19 20 21 22 
III. AFGGXFDXDFV 
XI. F G G G G F G D D F X 


Total=120 


0 


Distribution of odd letters 
Distribution of even letters 


A 
D 
F 
G v x 
A 
D 
F 
G v x 


~ :::: 
:::: - 
:::::: - 
~ 
:::::: 
,_ 0 
5 
3 
0 
,_ 1 
8 
4 
2 


-~· 


185 


Weighted values of distributions: 


On the basis of figure 69 normal (odd letters as 9,'s, even letters as 02's): 


0{3)+1(11)+5 {3)+3(8)+0(11)+1(6)=56 56 


' 
56--= 47 
6 
1(4)+3(10)+1(11)+4(5)+ 1(4)+2(1)=71 
= 71 


Total=118 


On the basis of figure 69 reversed (even letters as 01's, odd letters as 02's): 


1(3)+3(11)+ 1(3)+4(8)+1(11)+2(6)=94 94 
94--= 78 
6 


0(4)+1(10)+5(11)+3(5) + 0(4) +1(1)=81 
=81 


Total=159 


Since the distribution here begins with an even-numbered position (12), and the greatest 
total is obtained on the basis of figure 69 reversed, the type of alternation for the second section 
of 11 letters is therefore again 01-+92-+911 or " + ". 


THIRD SECTION (letters 23-33) 


23 24 25 26 27 28 29 80 31 32 33 
III. V X G F X F D X D D A 
XI. X D A F D, D X G G A V 


Distribution of odd letters 
Distribution of even letters 


A D F G V X 
A D F G V X 


,_ 2 
3 
0 
2 
2 
3 
,_ 1 
3 
3 


Weighted values of distributions: 
On the basis of figure 69 normal (odd letters as Si's, even letters as 9-'s): 


2(3) +3(11) + 0(3) +2(8) +2(11) +3(6) =95 95 
95--= 79 
6 
1(4)+3(10)+3(11)+1(5)+ 0(4)+2(1)=74 
- 
74 


Total=153 


On the basis of figure 69 reversed (even letters as 01's, odd letters as 92's): 


1(3)+3(11)+ 3(3)+1{8)+0{11)+2(6)=65 65 
65--= 54 
6 
2(4) +3(10) +0(11) +2(5) + 2(4) +3(1) =59 
- 
59 


Total=113 


0 
2 


Since the best values are obtained on the basis of figure 69 normal, the type of alternation for 
the third section of 11 letters is 01-+9ll-+011 or"+". 


ll 


Ji 


·lS6 


k. Now if columns 1 and 2 contain 11 letters, and the total number of letters is 186, the 
transposition rectangle obviously has 17 columns, there being 16 long columns of 11 letters and 
one short column of 10 letters [(17Xll)-1=186]. 
l. There is another ccyptogram which also contains but one short column, viz, VII, of 254 


letters [17X15) -1 254]. The columns of this cryptogram contain 4 more letters than the 
corresponding columns Of III and XI. Assuming, momentarily, that the last column is the short 
one, cryptogram VII may be added to the superposition of III and XI, provided these sets of 4 
additional letters are accounted for. This has been done in figure 72. In that figure the 4 
extra letters pertaining to cryptogram VII are shown as falling under the last letters of the col- 
umns of cryptograms III and XI, but this is only an arbitrary placement. It is sufficient to 
place these extra letters in such positions as will make the first one of the series begin in an even 
position. 
m. Since the transposition rectangle is now known to be 17 columns wide, the data in figure 
69 may be enlarged to correspond to this information. For example, whereas in originally 
constructing figure 69 the first column of cryptogram I was assumed to have only 8 letters (to 
correspond to a key of 25 numbers), it may now be extended to a column of 12 letters, and so on. 
The- additional portions ·used ·to make the distributions in· figure 74 are shown ·und~litied in 
figure 73; 


2 
3 
4 
II 
II 
7 
8 
9 
10 
II 
12 
18 . 14 
15 
Ill 
17 
. 111 
19 . 
20 
21 .. 
22 : : 


III. D A G A A F 
G A G 
V. 
D A F 
G G X F 
D 
XI. V F 
D D V A X G D A D F 
G G G G F 
G 


VII. G A F 
G F 
F 
X 
F 
V 
F .. G. A 
G .G 
X D X X 


X D F V 
D D F X 
D D F A 
G V D D 
F X A V 


III. V X G. f 
X 
F P 
X D D A G 
XI. X . b A.. F . o· . D. JC G G 
A 
V 
G ADD G V .. A .DD VD 


A 
G. 
D V D F If ... F 
D D 


Vll.V D V .F F 
A D A V A V A D 
A .. A 
F 
V ... F ___ D ... F 
V 
D 


X F X X 
F V G G 


55 
56 
67 
68 
59 
60 
61 
112 
63 
114 
115 
66 
IILD G A F 
G A 
V G D G X 
Xl.D G A F A F DA· A A· G 
VII. G D X D D F V D F F X 


D V F X 


D D D A ·v F 
V 
D D 
F' D· 
V A V F G G V A·D D G 
V'A DX VAX D V X A 
F F V D 


III. A A A A D X A G D X A G G D D A V G 
XI. D D F 
G F 
V D D A D F 
G A F 
D F 
V D 
VII. F D G X F D G F D D F A A F V F F V 


V F G D 
D F V V 
X D G F 
D D V A 
V D V V 


98 
99 
100 
101 ' 102 
103 
104 
105 
106 
107 
1011 
109 
110 


III. V 
F 
V · D G'. G X G G. A F 


XI.V A D A G· D X F X X X 
VII. D D F 
D D D X :F . F 
A G 
F X F X 


F 
V F 
D A X G D D D G 
F F D X G D F D G F D 
A A G V D G G V D F G 
G G X D 


111 
112 
113 
114 · -115. ·116 
117 
mi 
110 
120 
121 
122 
123 
124 
125 
126 
121 
1211 
120 
mo 
1s1 
1a2 
III. D A F 
D A D 
G G A .. D D G D X A F 
V D F 
D X F _ 


XI. D. F 
-G.· D A G F A A ·c ·· G A ·o 
X D G V D G A v· :(:f 
VII. F 
D F v A F 
F 
G F x G G D ··a 
G . D ··o 
A v D x A" 


D A X D 
D F 
A F 


F1ou111: 72. 


III. V G D D V A V F 
D D D V F 
A G D F 
F 
XI. V D F D D F X G A G X F G V F V V D 
VII. V F X D D X V A G D V X D G X X D V 
V D D F 


F X A A 
G V D X 
F V F D 
D D D A 


155 
166 
1.~7 
1511 
159 
160 
161 
162 
163 
164 
165 
1116 
167 
1611 
1119 
170 
171 
172 
173 
174 
176 
176 


111.D FAD G 
G 
V 


XI.D FF F 
X G X 
VII.A F D F 
X D X 


F D A V D G X F V D A 
G X A 
G A G V G D V V 


G D A A D V D D V A D 
F V D F 


177 
178 
179 
180 
181 
182 
183 
184 
1~6 
lM 


III. X 
F 
G 
G .o 
D 
X 
G 
D 
A 
XI. D X D D X F V D D X 
VII. A F 
V F X F 
A A V D 
D F V D 


FIGURI: 72.-Contlnued. 


A V G D 
X G F V 
D V D V 
A V D G 


Cryptogram Length 
Letters taken 
Cryptogram 
I..ength 
Letters taken 


I 
212 
VDDGGGVFDFVD 
VII 
254 
GAFGFFXFVFGFXA 
II 
108 
VDAAVD 
VIII 
144 
DGVVGFXG 


III 
186 
DAGAAFGAGV 
IX 
182 
GDDDDXVGVD 
IV 
110 
ADXVFX 
x 
130 
DGDDFVF 
v 
202 
DFXFDDVVVDX 
XI 
186 
VFDDVAXGDA 


VI 
120 
GDGFXAG 
XII 
224 
XFDFXVVDVDA¥Q 


FIGURE 73. 


The new frequency weights are therefore as follows: 


Odd (1st_. 3d, . . . ) letters 
A D F G V X 


::::: 
~ 
i!1E 
~ 
~ 
~ 


~ 
~ ~ ~ 


~ 
- 
~ 


Total - 
4 + 14 + 5 + 11 + 15 + 10 • 59 


FIGURE 74. 


Even (2d, 4th, . • . ) letters 
A D F G V X 


~ 
~. i!1E 
i!1E 
i!l 
::::: 


~ 
~ 
~ 
~ :::: 


Total = 9 + 16 + 14 + R + 7 + 2 - 
M 


Since the two totals are quite close together, no correction need be made of the nature of that 
made in preceding calculations, where one-sixth was deducted from the total values of odd letters. 
n. Beginning with position 23, in the case of cryptograms III and XI, the next 11 letters, 


and, in the case of cryptogram VII, the next 15 letters are clearly of the"+" type of alterna- 
tion. The data are as follows: 


23 24 25 26 27 28 29 30 31 32 33 
III. V X G F X F D X D D A 
XI.XDAFDDXGGAV 
VIL V D V F F A D A V A V 


F VG G 


j 
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Distribution of odd letters 
Distribution of even letters 


A D F 
G v x 
A D F 
G 


::::: - 
:::: - 
:::: 
~ :::: 
:::: - 
:::: 
~ ::::: 


::::: 
,_ 2 
4 
3 
7 
3 
,_ 4 
4 
Ii 
2 


Weighted values of distributions: 


On the basis of figure 74 normal (odd letters as 01's1 even letters as 02's): 


2(4) +4(14) + 1 (5) +3(11) + 7(15) +3(10) =237 
4(9)+4(15)+5(14)+ 2(8)+ 0(7)+ 2(2) 
186 


Tote.1=423 


v 


0 


On the basis of figure 74 reversed (even letters as 91's, odd letters as 9'21s): 


4(4) +4(14) + 5(5) +2(11) +0(15) +2(10) = 139 
2(9)+4(15)+1(14)+ 3(8)+ 7(7)+ 3(2) 
171 


Tote.1=310 


x 


::::: 


2 


Since the greatest tote.I is obtained on the basis of figure 74 norme.I, the type of alternation for the 
third section of letters is 01~ 02~ eh or 11 + ". 


o. Continuing the foregoing process with the letters beyond position 33, the data are as 


follows: 


34 35 36 37 38 39 40 41 42 43 44 


III. 
G A D D G V A D D 'y D 
XI. 
G A G D V D F D F D D 
VII. 
A D A A F V F D V F D 


XFXX 


Distribution of odd letters 
A D F 
G v x 


:::: 
~ - 
:::: 
:::::: 


Distribution of even letters 
A D F G V X 


::::~~§§~----- 


~ 
,_ a 
8 
1 
0 
3 
2 
1- a 
s 
11 
' 
2 


Weighted values of distributions: 


On the basis of figure 74 normal (odd letters as 01's1 even letters as 0ii's): 


3{4)+8(14)+ 1(5)+0(11)+3(15)+2(10)=194 
3(9)+5(15)+5(14)+ 4(8)+ 2(7)+ 1(2)=220 
Tota.1=414 


On the basis of figure 74 reversed (even letters as 01's, odd letters as 02's): 


3(4) +5(14) + 5(5) +4(11) +2(15) + 1(10)= 191 
3(9)+8(15)+1(14)+ 0(8)+ 3(7)+ 2(2)=.!_86 
Tota.1=377 


/ 
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Since the distribution begins here with an even-numbered position (34), and the greatest total is 
obtained on the basis of figure 74 norme.I, hence the alternation for the fourth section or column 
is of the type e2~ ei-~ 92, or"-". 


p. (1) The data for the letters beyond position 44 a.re as follows: 


45 46 47 4H 49 50 51 
fi2 53 M 55 


III. 
DGAFGAVGDGX 
XI. 
D G A F A F D A A A G 
VII. 
GDXDDFVDFFX 
D VF X 


Distribution of odd letters 
Distribution of even letters 


A 
D F 
G 


:::: 
~ - 
:::: 


I= 
4 
3 


v 


:::: 


3 


x 


:::: 


4 


A D F G V X 


::: 
~ 
~ ~ 


,_ 3 
4 
6 
4 
0 
0 


Weighted ve.Iues of distributions: 
On the basis of figure 74 normal (odd letters as 0i's, even letters as 92's): 


4(4) +5(14) + 1 (5) +3(11) +3(15) +4(10) =209 
3(9)+4(15)+6(14)+ 4(8)+ 0(7)+ 0(2)=203 
Tote.1=412 


On the basis of figure 74 reversed (even letters as 01 
1s1 odd letters as 02's): 


3(4) +4(14) + 6(5) +4(11) +0(15) +0(10) = 142 
4(9)+5(15)+1(14)+ 3(8)+ 3(7)+ 4(2)=178 


Tota.1=320 


Since the distribution starts with an odd position (45) and the greatest tote.I is obtained on the 
basis of figure 74 norme.I, the type of e.Iternation for the fifth section or column is 91~ 0r+ 9 11 
or 


11 +". 
q. The types of e.Iternation for the first 5 columns, which a.re eJl long columns, is there- 
fore + + + - 
+. Since cryptograms III and XI contain but one short column, it is advisable 


to be on the lookout for it as the work progresses. It is possible to continue with the process 
detailed above. For example, the ce.Iculations for the next or sixth section of 11 letters a.re 
shown below: 


56 ff1 58 59 60 61 62 63 64 65 66 
III. DDDAVFVDDFD 
XI. V A V F G G V A D D G 
VII. 
V A D X V A X D V X A 
FF VD 


Distribution of odd letters 
A D F G V X 


~ ~ ~ 
::: 
,_ Ii 
4 
4 
2 


Distribution of even letters 
A D F G V X 


-2-::::~-- 


f= 1 
7 
2 
8 
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Weighted values of distributions: 
On the be.sis of figure 74 normal (odd letters a.s 01's, even letters as 02's): 


5(4) +4(14) + 4(5) + 1(11)+1 (15) +2(10) = 142 
1(9)+7(15)+1(14)+ 2(8)+ 8(7)+1(2) =202 
Total=344 


On the be.sis of figure 74 reversed (even letters a.s 01's, odd letters a.s 02's): 


1(4) +7(14)+ 1(5) +2(11) +8(15) + 1(10) =259 
5(9)+4{15)+4(14)+ 1(8)+ 1(7)+ 2(2)=180 


Total=439 


Since the distribution starts with an even position (56) and the greatest total is obtained on the 
be.sis of figure 74 reversed, the type of alternation for the sixth section or column is 01~0r~0i, 
or"+". 


r. But perhaps advantage should be taken of the availability of additional cryptograms. 
For example, cryptogramV,of 202 letters, has 2 short columns [(17X12)-2=202], whereas the 
cryptograms thus far dealt with each have but one. That is, cryptogram V has one short column 
in common with cryptograms III, XI, and VII, and one additional short column not possessed 
by the latter. Can this additional short column of cryptogram V be located? 


s. Suppose column 1 of cryptogram V is the additional short column. Then the letters of 
column 2 -would be F X F X F F F V A G F D. 
These letters when evaluated on the 
basis of figure 74 normal yield a total of 77; when weighted on the basis of figure 74 reversed, 
a total of 144. The calculation is as follows: 


Distribution of odd letters 
A D F G V X 


~ 


Distribution of even letters 
A D F G V X 
- - 
::::::: 


1- 
1 
0 
6 
0 
0 
0 
!= o 
1 
2 


On 'the be.sis of figure 74 normal (odd letters a.s Si's, even letters as 02's): 


1 (4) +0(14) + 5(5) +0(11) +0(15) +0(10) =29 
0{9)+1(15)+1(14)+ 1(8)+ 1(7)+ 2(2)=48 
Tota.1=77 


On the be.sis of figure 74 reversed (even letters as 0i's, odd letters as 02's): 


1(9)+0(15)+5(14)+ 0(8)+ 0(7)+ 0(2)=79 
0(4)+1(14)+ 1(5)+1(11)+1(15)+2(10) 65 


Tota.1=144 


According to this calculation, column 2 of cryptogram V seems to correspond to the type of 
alternation 02~81~02, that is"-". But from previous work it is fairly certain that column 2 
is of the"+" type. Hence, column 1 of cryptogram V is probably not the additional short 
column of that message. Assuming column 2 to be the extra short column, no such contra- 
diction is obtained, for the calculation is as follows: 
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Assuming column 2 to be short, the letters of column 3 a.re X A V D A G F D V D G F. 


Distribution of odd letters 
Distribution of even letters 
A D F G V X 
A D F G V X 
= 
~ 


1- 
1 
0 
1 
1 
2 
1 
/- 
1 
3 
1 
1 
0 
0 


Weighted values of distributions: 


On the basis of figure 74 normal (odd letters as 01's, even letters as 02's): 
1(4)+0{14)+1{5)+1(11)+2{15)+1(10) 
= 60 


1(9)+ 
3(15)+1(14)+ 1(8)+90{7)+0{2)= ~ 


Total=136 


On the basis of figures 74 reversed (even letters as 01's, odd letters as 02'2): 


1(9)+0(15)+1(14)+ 1(8)+ 2(7)+1 (2)= 47 
1(4)+3(14)+ 1(5)+1(11)+0(15)+0(10)= ~ 
Tote.1=109 
Since the greatest tote.I is obtained on the basis of figure 74 normal, the type of alternation is 
01 ~02~01 and column 3 is a "+" column, which is consistent with the formula. + + +- + for 
columns 1 to 5, as previously ascertained. 
If all the foregoing reasoning is correct, and column 2 is the additional short column for crypto- 
gram V, it must be the next to the la.st column of the transposition rectangle. Since it is a 
" +" column, the le.st column must be a " - " one; therefore, there a.re 9 " - " columns and 
8 "+" columns. This definitely determines that the"-" columns a.re the odd ones, the"+" 
columns the even ones, since in an odd-width rectangle there is one more odd column than even 
columns. 
t. The single short column which is common to cryptograms III, XI, and VII is one of the 
columns beyond column 5. Assuming ea.ch possibility in turn, there is obtained for the type of 
alternation in each column the distributions of"+" and"-" shown in figure 75. 
. 
Column 
Assumption 
1 2 
3 
4 
5 
6 
7 8 
9 10 11 12 13 14 15 
--- - - - - - - - - - - - - 


(1) 6th short ___________________________ + + + - + + + + - + + + - - - 
(2) 7th short·-------------------------- + + + - + + - + - + + + - - - 
(3) 8th short ___________________________ + + + - + + - - - + + + - - - 
(4) 9th short ___________________________ + + + - + + - - + + + + - - - 
(5) 10th short _________________________ + + + - + + - - + - + + - - - 
(6) 11th short _________________________ + + + - + + - - + - - + - - - 
(7) 12th short _________________________ + + + - + + - - + - - - - - - 
(8) 13th short _________________________ + + + - + + - - + - - - + - - 
(9) 14th short _________________________ + + + - + + - - + - - - + + - 
(10) 15th short _________________________ + + + - + + - - + - - - + + + 
(11) 16th short _________________________ + + + - + + - - + - - - + + + 
(12) 17th short _________________________ + + + - + + - - + - - - + + + 


FIGURE 75. 


u.. The correct assumption must satisfy the following conditions: 


(a) There must be 9 ":-"and 8 "+"columns. 
(b) The short column must be"-". 


324155--41~10 


Summation of 
16 17 
+•aand-'s 


- 
- - 
10+, 7- 
- - 
9+, 8- 
- - 
s+, 9- 
- - 
9+, 8- 
- - 
8+, 9- 
- - 
7+, 10- 


- - 
6+, 11- 
- - 
1+, 10- 


- - 
s+, 9- 
- - 
9+, 8- 
+ - 
10+, 7- 
+ + 11+, 6- 


I I 
I 
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Only assumptions (3) e.nd (5), in which column 8 and column 10 are short columns, satisfy these 
conditions. Therefore, column 2 is followed by either column 8 or 10. Testing the combination 
2-8 for monoe.lphabeticity of bipartite pairs, the distribution shown in figure 76 is obtained. 
When combination 2-10 is tested, the distribution shown in figure 77 is obtained. Obviously, 
the 2-8 combination is the better. 


A 


v 
x 


2d component 
A 
D 
F 
G 
V 
X 


I I I I I 
1-1 I 1-1- 
---I I 
1~1~1 


:::::1~1 I I I 
I I I I I 
I 1-1 
I::::: I 


E (cp)=.0667X17X16=18.14 
cp = 22 


FIOl'RE 7R. 


A 


j D 
! : 


v 
x 


2d component 
A 
D 
F 
G 
V 
X 


I I I I I 
1-1 I 1-1- 
I::::: I::::: I 1-1- 
-1-1-1-1 ,- 
I I I I I 
,-, 1-1-1 


E (cp)=.0667X17Xl6=18.14 
cp = 4 


F1011a11: 77. 


v. It is possible by introducing cryptograms with additional short columns to determine 
more of the key. Thus, it was found by using cryptograms XII and VI that the first 3 numbers 
of the transposition key are 16-5-7. But the process of anagramming will yield the solution at 
lee.st as rapidly. In this process, of course, advantage may be taken of the fact that the columns 
have been classified into the "+" and " - " types and no combinations of two "+" or two 
" - "columns need be tested, since only combinations of the type"+ - "or" - +"are permissible. 


w. The fine.I transposition key and the substitution checkerboard are shown in figure 78. 


16 
5 
7 
6 
9 
3 
14 
1 
13 
II 
17 
10 
4 
12 
Iii 
~ 
II 
V I 
K I 
N G S 
C R 
0 
W N H 0 
T 
E 
L 


2d component 
A 
D 
F 
G v x 


A v 
I 
9 
K 
N 
G 
-------- 
... D 
7 
s c 
3 
R 
0 
= 
! 
-------- 
t F w H 
8 
T 
E 
5 


8 
-------- 


:ii G L 
A .! 
B 
2 
D 
---------- 
v 4 
F 
6 
J 
8 
M 
---------- 
x p 
Q u x 
y z 


FIOVRE 78. 


x. All the foregoing details concern a case in which the transposition rectangle has an odd 
number of columns. Now if the rectangle contains an even number of columns, this type of 
solution is, of course, stiII applicable, and in fa.ct is easier, since the letters of the text of the re- 
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spective sections do not have to be distributed into odd and even letters. It is only necessary 
to identify a section as being composed of initial components or of final components. This 
analysis then produces a series of sections corresponding in number with the number of columns 
in the transposition rectangle. This number will, of course, be even. By a careful study of 
where alternations in composition of components (01 or 02) occur, the division of the text into 
sections corresponding to long and short columns can be accomplished. The remaining steps 
are obvious and follow the lines elucidated in paragraph 39e-j. 
y. The entire structure upon which this general solution rests is destroyed if the substitution 


ch<-'ckerbooi-d has been consciously manipulated to equalize or :flatten out the sums of the weighted 
frequencies of the letters in its rows and columns. For example, note the following checkerboard, 
which is not "perfect" but gives approximately similar frequencies in its rows and columns.a 


2d component 


A 
D 
F 
G 
v 
x 
Sums 


A 
I 
Q 
s 
u 


74 
3 
61 
26 
164 
------ 
T 
w 
c 
p 
92 
16 
31 
'D 
166 
D 
------ 
G 
A 
N 
16 
74 
79 
169 
x 
v 
J 
E 
B 
K 
5 
15 
2 
130 
10 
3 
165 
------ 
R 
M 
F 
L 
76 
25 
28 
36 
165 
v 
------ 
D 
z 
y 
0 
H 


42 
1 
19 
75 
34 
169 
x 


Sums 
171 
177 I 
166 
1115 
158 
163 
1,000 


FIGUR&79. 


z. If the statistical calculations upon which this general solution is based make use of the 
logarithms of the frequencies instead of the frequencies themselves, much more accurate and 
clear-cut data will be obtained. 


s The frequencies indicated as those given in fig. 3, p. 13, Military Cryptanalyria, Part I. 
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44. Review of principles underlying the cryptographic method.-8everal bifid fractionating 
systems have been explained in previous texts of this series.1 In certain of these systems four 
basic steps are involved, two of substitution and two of transposition. These steps may be 
briefly described as follows: (1) A process of decomposition (substitution), in which each plain- 
text letter is replaced by two components, e! and 0~, of a bifid or bipartite alphabet; (2) a 
process of separation (transposition), in which the 0 10! components originally paired together 
are separated; (3) a process of recombination (transposition), in which the separated compo- 
nents are combined to form new pairs; (4) a process of recomposition (substitution), in which 
each new pair of components is given a letter value accord~ to the original or a different bifid 
alphabet. 
45. Example of a simple bifi.d cipher.-a. One of the simplest bifid fractionating systems 
is that exemplified in the following subparagraphs. It will be employed to set forth certain 
principles in the general solution of systems of this and similar nature. 
b. Given the 25-cell substitution checkerboard shown in figure 80, let the message to be 
enciphered be ONE PLANE REPORTED LOST AT SEA. 
The first step is to replace the plain- 
text letters by ~he bipa~tite equivalents, the two elements or components being set down ver- 
tically beneath the plain-text letters. This represents the :first two of the four processes re- 
ferred to in paragraph 44, the first being that of decomposition or substitution, the second, that 
of separation or transposition, represented by the manner in which the two bipartite elements 
are set down vertically (instead of horizontally), thus separating the two elements from their 
normal horizontal juxtaposition. 


1 See Special Text No. 166, Adoanced Military Cryptography, sec. XI and Military CryptanalyBia, Part I, 
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Plain text ______ o N E 
Components __ {' 
1 
3 


2 
3 
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2d component 


1 
2 
3 
4 
5 


M A 
N u 
F 
I--- 
c 
T 
R 
I 
G 
I------- -··· 


B 
D 
E 
H 
K 
----------- 
L- 
0 
p 
Q s 


,_______ ---- -----,_ 
v w x y z 


FIGURE RO. 
PLANE REPORTED LOST AT SEA 
,,113 23442233 44•2 12 
431 


8 
1 
2 
3 
3_ 
3 
8 
3 
2 
8 
2 
3 
2 
1 
2 
5 
2 
2 
2 
5 
3 
2 


The third process, that of recombination or recomposition, also involving a transposition, is now 
to be performed and will consist in combining elements standing in diagonal relationship to the 
right, that is, as shown by the arrows below: 


ONE PLANE REPORTED LOST AT SEA 
<113 
44113 23442233 4442 
12 
431 
l' 3)1 3 )' 3)1 1)1 2)1 3)1 8 
3 
3 s 
2 
3 
2 
3 
2 
1 
2 
5 
2 
2 
2 
5 
8 
2 


giving the pairs 21, 33, 34, 34, 11, 21, 33, etc. There are left, at the end of the process, one 
element in the upper line at the extreme left and another element in the lower line at the extreme 
right, yielding the pair 24, which may be placed at the head or tail of the resultant combinations, 
as preagreed. The last or fourth process, that of recomposition or substitution, is to replace the 
new pairs of components by letters from the original or a new checkerboard. If the same 
checkerboard is used, it yields the text shown herewith: 


Plain _____________ o N E 
Components . .l';i 1 ;i 3 ;i 
la 3 
3 
Cipher ___________ c E H 


PLANE 
4 
4 
1 
1 s 


al'/ I' I' a 
HM CED 


REPORTED 
2 a • ' 
2 
2 a s 
38823282 
EHHTDREI 


L 0 S T 
4 
4 
4 
2 


1 
2 
IJ 
2 
U I W C 


AT 
1 
2 


2 
2 
T I 


SE A 
' 
3 
1(4) 


IJ 
3 
2 


X B I 


c. Another and perhaps more simple way of accomplishing the same process is to set down 
the bipartite equivalents horizontally and recombine them as shown below: 


0 N E P L A N E 
4213 
33 
43 
411213 
33 
.. 
v v 
'V' v 
'V' '\)' '\?' '\)" 
C E H H M C E 


The results are identical with those obtained from the preceding manner of operation. The 
text is of course sent in 5-letter groups. 
d. Instead of using the digits l, 2, 3, 4, 5, as the bipartite components one can use the 


vowels A, E, I, 0, U, or Rny other characters that are deemed suitable. Perhaps digits are best 
as they are less likely to be confused with letters of the text. · 


e. As intimated above, the checkerboard used for the recomposition may be different from 
that employed in the decomposition. But it will be shown that the additional safety affo;rded 
by ming two different checkerboards is somewhat illus0cy, and is by no means as great a.s may 
appear on first consideration. 
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46. Principles of solution.-a. Note the following skeleton encipherments, using the 
checkerboard shown in figure 80: 


C E N 0 
SEND 
REN C 
HEN A 
TEN Y 
2 31 ' 
4 31 3 
2 31 2 
3 31 1 
2 31 6 
.l' .l' .l' 
i 
a a 2 
.l' .l' .l' 
6 
3 
3 
2 
3 a 3 
l 
4 
3 
3 
2 
2 
3 
3 
4 
N~H 
X~E 
E~D 
p ~ B 
R~K 


{ 1) 
(2) 
(3) 
(4) 
( 5) 


These five cncipherments have in common a plain-text digraph EN. 
The five cipher versions, 
however, have only a single letter in common, B. 
This is, of course, a phenomenon already 
encountered many times by the student and its cause is easily understood by him: The mechanics 
of the system tend to reduce by one character the lengths of the repetitions in the cipher text, 
as compared with their lengths in the plain text, a trigraphic repetition in the plain text mani- 
festing itself as a digraphic repetition in the cipher text, a tetra.graphic one becoming a trigraphic, 
and so on. More will later be stated on this phase of the matter. 
b. But now study the individual cipher letter immediately preceding and succeeding the 
cipher letter which these five encipherments have in common. They are as follows: 


Letters preceding B0 ____________ N, X, E, P, R 
Letters succeeding Be------------H, E, D, B, K 


Reference to the checkerboard discloses the very interesting and important fact that the letters 
preceding the cipher repetition (Be) all come from the same column in the checkerboard, the lettera 
aucceeding the repetition all come from the same row in the checkerboard. How this phenomenon 
is brought about is quite simple to see. 
Take the first of the five examples, that in which 
C E N 011 produces N B He. 
The Ne is the result of combining the second component of the 
bipartite equivalent of CP with the first component bipartite equivalent of Ep, yielding the com- 
bination 13, which is N. 
No matter what the other three letters in the plain-text tetragraph 
may be, if the second letter is Es,, the second component bified equivalent of the first letter of 
the cipher trigraph must be a 3. This means that this first letter of the cipher trigraph must 
come from column 3 of the checkerboard. Exactly which row this letter will com~ from is deter- 


min~ by the identity of the second component of the bifid equivalent of the first letter of the 
plain-text tetra.graph. Hence, since the 5 tetra.graphs in the example all have the same plain- 
text letter in the second position, the initial letters of the cipher trigraphs all must come from 
the same column of the checkerboard. It is unnecessary to go through the reasoning, which is 
parallel, in the case of the third letters of the cipher trigraphs: these all must come from the 
same row of the checkerboard. 
c. A good understanding of the phenomenon just noted can certainly be employed to 
advantage in solving this and similar types of systems, for it becomes obvwua that a careful study 
of the lettera immediately preceding and following cipher repetitions ahould facilitate a reconstruction 
of the checkerboard emp'loyed in the substitution.1 
Indeed, if there were no other phenomena to 
disturb this very simple relationship, solution would be quite easy. .All that would be required 
would be to study the prefixes and suffixes to all the A's, B's, C's, . . . in the cryptogram, find 
the letters which belong in the same columns and rows of the checkerboard, and the reconstruc- 
tion of the latter would follow very simply. Unfortunately, however, there is a disturbing 
phenomenon which must now be considered. 


1 The principle involved in such reconstruction was, to my knowledge, first pointed out and successfully 
employed early in 1938 by ASBociate Crypt&nalysts S. Kullback and A. Sinkov. 
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d. Note the following encipherments: 
Plain ____________ 
L 
p 


41 
43 
Cipher _________ 
u 
B 
( 6) 


Hi 


u 
R 


14 
23 


0 


0 
R 
M 
I 


42 
23 
11 
2' 


T 
B 
A 
(7) 


Here the Be is preceded by l~tters (U and T) which not. only arr not in t.h<' l:lamP column ltK t.11ose 
in the corresponding position in the case oft.he first fivP rnciphrrments, hut. also t.hr.sP two lt>tters 
are themselves in different columns. The cause of this il:l not difficult to sec. It is merPly that 
the second component of the PP and the second component of the RP happen to be identical, the 
first component of the UP and the first component of the MP also happen to be identical, thus 
producing the same cipher letter in both cases. This is a phenomenon which must happen by 
chance a certain number of times, a number which is dependent not only upon the mechanics 
of the system but also upon the exact composition of the checkerboard. Disregarding for the 
moment the latter factor, it is obvious that if the checkerboard is perfectly balanced, the bifid 
element 3, for example, should occur 20 percent of the tim 
1e as ~e first or as the second element 
of a bifid pair, since there are 5 elements and each can theoretically appear an equal number of 
times. However, since the checkerboard is not perfectly balanced, the bifid element 5 can, in 
the case of figure 80, appear as a second component of the bipartite equivalent of a cipher lette1 
only very rarely, since it corresponds to the first component of the bifid equivalents of the letters 
V, W, X, Y, and z, all of which are of low frequency. 
On the other hand, the bifid element 3, in 
the case of figure 80, can appear very frequently as a first component of the bifid equivalent of 
a cipher letter because it is the second component of the bifid equivalents for the high-frequency 
plain-text letters N, R, and E, which are all in column 3. However, since the exact composition 
of the checkerboard is unknown when cryptograms of this sort are to be solved, fr(1quency 
weights can, of course, not be assigned to any of the components or bipartite elements and it 
will have to be assumed that each one has an equal probe bility of occurrence, that is, one-fifth. 
e. From the foregoing discussion it is obvious that it would be unwise merely to study the 
prefixes and suffixes to identical single letters of the cipher text in an attempt to solve crypto- 
grams of this sort, for the disturbing effect of the accidental identities of certain cipher letters 
would be sufficient to retard solution. A few detailed examples of the type of study that must 
be made in connection with repetitions in such systems as this will now be given. 
f. It was stated in subparagraph a that the mechanics of the system tend to reduce by one 
character the lengths of the repetitions in the cipher text. The expression "tend to reduce" 
aptly describes the situation, for not only can it happen that a 3-letter repetition in the plain 
text may appear to remain a 3-letter repetition in the cipher text, but also it can happen that 
a 3-letter repetition in the plain text may even appear as a pseudo 4-lettcr repetition in the 
cipher text. Study the following examples (based on fig. 80) and note what happens in each case: 


~ F 
T 
H 
E 
C 
~ = ~ 
~ 
~ 
~ 
~ 
16 
22 
34 
33 
21 
w !LJ 
D 


(B) 
y 
T 
H 
E 
y 


M 
22 
34 
33 
M 


T 
22 
(B) 


0 
!LJ 
K 


(1) 


D 
R 
p 


T 
H 
22 
34 


T 
R 
p 


{2) 


E 
33 


E 


E 


H 
34 


c 


A 
12 
L 


A 3-letter plain ten repetition appears as a I-letter cipher text repe- 
A 3-letter plain-text repetition appears as a 3-letter cipher-text repe- 


tition. 
tltion because the 1st components of the D, and H, happen to be Identical 
(D and H are In same row In cbeckerboord). 


I 
N 
T 
H 
E 
G 


24 
13 
22 
34 
33 
25 
(A) 
L 
D 
R 
P 
D 


0 
R 
T 
H 
E 
U 
42 
23 
22 
34 
33 
14 
(B) 
T 
D 
R 
P 
B 


(3) 


148 


(A) 


(B) 


T 
0 
T 
H 
E 
M 
A 


~ 
42 
~ 
34 
~ 
" 
~ 


I 
T 
R 
P 
B 
M 


N 
D 
T 
H 
E 
N 
E 


u 
~ 
~ 
34 
33 
u 
33 


E 
T 
R 
P 
B 
E 


(4) 


A 3-letter plain-text repetition appears as a 3-letter cipher-text repetl- 
A 3-letter plain-text repetition appears BS a 4-letter cipher-text repe- 
tlon because the second component of the No and Ro happen to be iden- t.ltlon because the phenomena of case 2 and case 3 occur simultaneously 
tlcal (Rand N are in same column In checkerboard). 
(0 and Dare In same column; II and N are In the ~ame row In the checkrr- 
board). 


g. From a study of these phenomena the rule may .be deduced that an n-letter repetition 
in the plain text is really reduced to an (n-1)-letter repetition in the cipher text, but it can happen 
fortuitously 8 that the real repetition is extended on either or both ends of the repetition by a 
pseudo-repetitious letter. Hence, a 3-letter plain-text repetition may appear as a 2-, 3-, or 
4-letter repetition in the cipher-text. 


k. It is therefore possible to make wholly erroneous deductions from some repetitions, es- 
pecially if the latter are short. Note for instance the following example, still using Fig. 80 
as a basis: 


F 
0 
U 
R 
D 
A 
(YS) 
S 
0 
M 
E 
D 
U (TY) 


111 
42 
14 
23 
32 
12 
411 
42 
" 
33 
32 
14 
y 
c 
0 
D 
c 
y 
c 
N 
D 
c 
Here are 2 sequences of 5 cipher letters, identical save in the central letter, and yet the 6-letter 
plain text sequences have only 2 letters in common. This example is cited to show that the 
cryptanalyst must be very careful in respect to the deductions he may make in the case of short · 
repetitions. In the example cited it happens that the accidental repetitions are such as to make 
the sequences as a whole almost appear to be identical. 
i. It is these pseudo-repetitious elements which complicate the solution of what would 
otherwise be a simple system. To illustrate what is meant, note that in case (1) of subparagraph 
J the letters We and Oo, the prefixes to the repetition RP 0 ; do actually come from the same column 
of the checkerboard; the letters D0 and K0 , the suffixes, do actually come from the same row. 
But now note in case (2) that while the prefixes D0 and T0 come from the same column, the suf- 
fixes C0 and L0 do not come from the same row. Note also in case (3) that while the prefixes 
Lo and To do not come from the same column, the suffixes, D0 and Be, do come from the same row; 
while in case (4) the prefixes turn out to be the same letter, Tc (which constitutes an example 
where the two prefixes come from the same column) but the suffixes, M0 and E0 , come from differ- 
ent rows. Since the exact length of the real repetition, without its pseudo-repetitious elements, 
does not readily manifest itself in the cipher text (although in favorable cases it may be deduced 
by a careful detailed analysis and comparison with nearly similar repetitions) the nature of the 
difficulties confronting the cryptanalyst become apparent. 
j. The nature of the detailed analysis and comparison of repetitions referred to above may 


. require a few words of explanation. Suppose that a cryptogram shows many occurrences of 


RPo (=THEP in the foregoing examples). It would indicate a high-frequency plain-text trigraph. 
A few repetitions of such cipher trigraphs as RPEc, DRP 0 , TRPB0 , would lead to the surmise that 
the latter are of the type where pseudo-repetitious clements have crept into the picture and there- 


• Strictly speaking, of course, not really fortuitously. It depends upon the exact letters whieh precede or 
follow the plain-text repetition and the exact positions these letters occupy in the checkerboard. 


·~ 


149 


fore the cryptanalyst should be very hesitant to assume that the adventitious prefixed letters 
are in the same columns, or that the adventitious suffixed letters are in the same row. In fact, 
he would be warranted in tentatively assuming the very opposite condition, that they are not 
in the same columns or rows, respectively. The conclusions derivable from a study of short 
repetitions can be carried over to the longer ones. Note the following four cases from which 
several conclusions may be reached: 


(1) 
U 
R 
P 
0 
S 
I 
T 
I 
0 
N 
S 
A 


" 
23 
u 
42 
~ 
24 
" 
24 
~ 
u 
~ 
ll 
0 
H 
H 
I 
W 
0 
T 
Q 
C 
H 
V 


(2) 
I 
S 
P 
0 
S 
I 
T 
I 
0 
N 
0 
F 


24 
42 
u 
42 
~ 
24 
ll 
24 
~ 
u 
~ 
u 
Q 
Y 
H 
I 
W 
0 
T 
Q 
C 
H 
C 


(3) 
H 
E 
P 
0 
S 
I 
T 
I 
0 
N 
D 
E 


M 
33 
0 
~ 
~ 
24 
~ 
24 
42 
ra 
~ 
33 
P 
H 
H 
I 
W 
0 
T 
Q 
C 
E 
R 


(4) 
0 
R 
P 
0 
S 
I 
T 
I 
0 
N 
L 
U 
42 
~ 
0 
42 
46 
~ 
~ 
24 
42 
u 
il 
" 
T 
H 
H 
I 
W 
0 
T 
Q 
C 
H 
M 


First, the 7-letter cipher sequence HI W 0 T QC is common to all four ca_ses; if only the cipher 
text were available, one could conclude that the plain-text repetition consists of 8 letters. Second, 
the letters H and Y probably come from the same column in the checkerboard, but as for 0, P, 
and T, they may or may not come from the same column, most probably not. 
(Actually, 0 and 
T do, but P does not come from the same column as these 2 letters.) Third, the letters Hand E 
probably come from the same row in the checkerboard, but as for V, C, and M, they may or may 
not come from the same row, most probably not. 
(Actually, all 3 letters come from different 
rows.) 
k. Note the following cases of encipherment: The fact that the 7-letter cipher sequence is 
common to all four cases means that the plain-text repetition consists of 8 letters. 


(1) 


(2) 


(3) 


(4) 


1 
N 
T 
13 
~ 


D 


2 
3 
4 
5 
6 
9 
11 
12 
13 
14 
15 
16 


P 
0 
S 
I 
N 
S 
I 
F 
T 
H 
E 
7 
I 


8 
T 


10 
0 


°"'~3,...--.,.,42,...-~46---..'4--.,,,,~,..---=24--4""'2-~13 
45. 
24 
15 
~ 
M 
33 
I 
I 
H 
I 
W 
0 
T 
Q 
C 
H 
W 
L 
W 
R 
P 
--·-··········-·-·----.;....._ _____ ..;:..._-.. ......... _ ....... . 


0 
N 
T 
P 
0 
S 
I 
T 
I 
0 
N 
F 
I 
F 
T 
H 
R 


fl 
D 
n 
g 
~ 
46 
24 
~ 
24 
42 
U 
W 
24 
M 
~ 
M 
~ 
C 
D 
I 
H 
I 
W 
0 
T 
Q 
C 
B 
W 
L 
W 
R 
0 


WASP 
0 SIT I 
0 
NL IF TIN 


~ 
ll 
46 
u 
42 
46 
24 
~ 
24 
42 
ra 
n 
24 
w 
~ 
24 
u 
C 
I 
Y 
H 
I 
W 
0 
T 
Q 
C 
H 
A 
L 
W 
T 
L 


T 
A 
L 
P 
0 
S 
I 
T 
I 
0 
N 
T 
I 
F 
L 
I 
S 
n 
12 
41 
u--4,...2--4'""5-'""'24,.,..__..,~,,....-24...,.,_-4,.,..2-'"""1""'a 
~ 
24 
111 
41 
24 
.. ~ 


C 
I 
U 
H 
I 
W 
0 
T 
Q 
C 
D 
T 
L 
Y 
A 
Q 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 


:1,: 
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The pseudo-repetitious letters, I in the third position in cases (1) and (2), and the letters 


Y., and U., in corresponding positions in cases (3) and (4) mean that I, U, and Y, come from the 
same column of the checkerboard. The I., in position 2, in cases (1), (3), and (4) and the D., 
in the corresponding position in ca"se (2) indicates that I., and D., are probably in different columns 
in the checkerboard. In position 11, the H0 , B01 and D., give indications of being in the same 
row of the checkerboard. In position 14, W., and Y0 likewise give indications of coming from the 
same row. But note now that from position 12 it may be deduced that W, A, and T come from 
the same column of the checkerboard. These are examples of the type of detailed analysis 
that the student should follow in his attempt to solve a problem of this sort. 
l. In general it may be said that when the repetitions are numerous and fairly lengthy, that 
is when there is a good deal of traffic all in the same checkerboard, and repetitions of tetragraphs 
and better are plentiful, solution should be relatively easy. In fact, with a fairly large amount 
of traffic, most of the work involved would consist in listing the 2, 3, 4 ... letter repetitions. 
Then a chart would be drawn up to show the associations which the prefixes make among them- 
11elves and the associations which the suffixes make among themselves. For example: 


X AB Q 
NABR 
Z ABT 
NAB Q 
LAB I 
Z ABT 
Here it is noted that L, N, X, and Z appear as prefixes to repetitions. The letter X is "found in 
company" with N twice; the "association value" of X and N is 2 units. The association value of 
Zand N is, however, 4 units, for the N occurs twice and so does the Z. 
The association value of 
LX or LZ is 1 unit; that of LN or LZ, 2 units. Thus, the association value for each combination 
can be studied in all the repetitions and, of course, when the value is high for a given combina- 
tion it indicates that the two letters really belong together, or in the same column of the checker- 
board. 
m. What can be done with but one or two relatively short cryptograms depends largely 
upon their lengths, the number of repetitions they happen to have, the exact construction of 
the checkerboard, and the ingenuity and patience of the cryptanalyst. Once the letters that 
constitute the columns and the rows of the checkerboard employed in the recomposition are 
known, the proper assembling of the columns and rows is a relatively simple matter. If a key- 
word has been used as the basis for the distribution or mixing of the letters, naturally the recon- 
struction of the checkerboard is much facilitated. If not, then either the original or an equiv- 
alent checkerboard may be reconstructed. 
Having the recomposition checkerboard at hand, 
the determination as to whether it is the same as that used in the decomposition follows directly. 
If not the same, the reconstruction of the decomposition checkerboard is a relatively simple 
matter. 


1 
2 
a 
4 
Ii 
11 
7 
s 
11 10 11 12 13 14 15 111 17 18 
111 20 21 22 23 24 25 26 27 28 29 30 31 a2 33 34 35 36 37 38 39 40 
EWVRVSDDTW 
DWVRVSDDTI 
RWVRVSDDTNULQDUB 
GUHKIRXYIRNGTIWAUUIAAQCWN 
PWVRVSDDTNULQDUHKIRXYIRNGTIWAUUIAAQCQDTQ 
XWVRVSDDTNULQDUHKIRXYIRNB 
LKIRXYIRNGTIWAUUIAAQCQDTV 


KIRNGSTLBDDTI 
NIRNGSTLBDDTW 


TWAUUIAAQD 


i - 
2I 
2B 
lB 
lD 
lL 
2D 
11 
2F 
lG 
lH 


----------------.--------------------------------------------------------------r.,--Q--D--T-i_o_w_-Y_i_-W_x_N __ I_N_"B_n_"R°_Q ________ lH _________ _ 


WSAVI 
li 


Q S A V N I I U H Q D T X W I 
lE 
T A V N N I 
lF 
Q A V N I I U H Q D T X D W Y I W X N I N B D R W 
2G 
L Q D T X C W S C I V D T N I L V N 
2H 
D L Q D T X W S C L P 
lK 
C Q D T Z 
lJ 


. :. ~ ~.. . . 
. 
~:-f 


N I L V N 0 D N U L Q D U B G 
21 


R W V R V S D D T N U L Q D U B I 
lB 


XWVRVSDDTNULQDUHK 
~ 


'>; J. 
L L Q D U K 
2C 


--.j'f ~~::~~-----------------------------------------------------------------T--V_T_i_N __ I __ N_D __ c_ii_-W_w_-r;·c--------------------------------1c---------- 


- :-· ,;~ - -------------------------------------------~--~-~-~--~-~-~-~--~-~-~-_'.'-~-~-~-~-------------------------:~--------- 
-, 
~.; r1 - 
D N B A X 
lA 
·:-t"0.\_ 
RNBAYIII 
2E 
· ._, r: -- 
T E W A Y I I L 
2E 


.. :1, -. 
I E W A Y U L Q 
IE 
t-------------------------------------------------------------------------------------------------------------------------------------------------------------------- 
... f · 
YI I I GTE WAY I 
2E 


. · ~, ¥ 
B I E W A Y U 
lE 
--' ! 
Q V E W C W S 
II 


l 
I S D C Y I W V E W D N B 
IA 


- - 
B G T E W V R 
2I 
T X D W Y I W X N I N 
lH 


~------------------------------------------------------------------------------------------------------------------------------------------------------------------- 
A I N B 
KIND 
WAX L 
BAX W 


FIGURE 81. 


lB 
2A 
2A 
2A 


1 
2 
3 
4 
5 
6 
7 
8 
9 ro 11 a ll H 
~ w u IB ill ~ ~ ~ 23 24 ~ $ 
~ ~ 29 ~ M ~ 33 u 35 ~ ~ 38 ~ ~ 


E W V R V S D D T W 
2I 


DWVRVSDDTI 
~ 


R W V R V S D D T N U L Q D U B 
lB 
G U H K I R X Y I R N G T I W A U U I A A Q C W N 
10 
P W V R V S D D T N U L Q D U H K I R X Y I R N G T I W A U U I A A Q C Q 0 T Q 
IL 
X W V R V S 0 D T N U L Q D U H K I R X Y I R N B 
20 


L K I R X Y I R N G T I W A U U I A A Q C Q 0 T V 
lI 
K I R N G S T L B 0 0 T I 
2F 
N I R N G S T L B 0 D T W 
IG 


TWAUUIAAQD 
IH 


tl 


le 
CI 
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47. Example of solution.-a. Suppose the two following cryptograms suspected of being in 
the same key are at hand: 
No. I 
Line 
A 
I S D C Y 
I W V E W 
D N B A X 
W S A V I 
W I L T K 
B 
X L Y I W 
D A I N B 
DR WV R 
V S D D T 
N U L Q D 
c 
UBI N R 
KV L Q D 
N L Q D T 
V T I N I 
N D C U W 
D 
W D C V S 
0 D C G S 
I S S G U 
H K I R X 
Y I R N G 
E 
T I W A U 
U I A A Q 
C W N B I 
E W A Y U 
L Q S A V 
F 
N I I U H 
Q D T X W 
I T A V N 
N I N D C 
U W W C G 
G 
T L G W W A L W D S 
N S I L N 
NI RN G 
S T L B D 
H 
D T W A U 
U I A A Q 
D G T E L 
Q D T X D 
W Y I W X 
I 
N I N B D 
R QT Q V 
E W C W S 
C L P I T 
L K I R X 
J 
Y I R N G 
T I W A U 
U I A A Q 
C Q D T Z 
I I W V T 
K 
I N I N D 
C U W W D 
S N I L V 
N 0 D L Q 
D T X W S 


L 
C L P W V 
R V S D D 
T N U L Q 
D U H K I 
R X Y I R 
M 
N G T I W A U U I A 
A Q C Q D 
T V 


No. 2 
Line 
A 
I W I L T 
G S I H W W A W K I 
N D C U W 
WAX L X 
B 
D I W I R 
C V N 0 D 
N G S L N 
G I G W L 
VF D WV 
c 
R V S D D 
T I L L Q 
DUK D W S S H X S 
E N C Q D 
D 
T Q G T E 
U D V Q C 
0 I W T X 
W V R V S 
D D T N U 


E 
L Q D U H 
K I R X Y 
I R N B A 
Y I I I G 
T E W A Y 


F 
I I L W N 
KIRN G 
S T L B D 
D T I T I 
L U D V L 
G 
V T T A Q 
A V N I I 
U H Q D T 
X D W Y I 
W X N I N 
H 
B D R W S 
C L P L W AHN TL 
Q D T X C 
W S C I V 


I 
D T N I L 
V N 0 D N 
UL Q DU 
B G T E W V R V S D 
J 
D T W 


b. A careful and detailed listing of significant repetitions is made, these to show the single- 
letter prefix and suffix in each case. 
A partial list of the many repetitions present in the two 
cryptograms is given in figure 81. 
c. Consider the first set of repetitions listed in figure 81, as extracted and shown in figure 82. 
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According to the principles elucidated in the preceding paragraph, it would seem that the 
following tentative deductions may be made from the data contained in the columns of figure 82: 
(1) From column 1: E, D, R, P, X belong in the same column of the checkerboard. 
(2) From column 10: W, I, N belong in the same row. 
(3) From column 14: D and G belong in the same column. 
(4) From column 16: Band H belong in the same row. 
(5) From column 16: Hand L belong in the same column. 
(6) From column 21: Y, K, N belong in the same column. 
(7) From column 25: G and B belong in the same row. 
(8) From column 27: I and T belong in the same column. 
(9) From column 33: I and W belong in the same row. 
(10) From column 36: C and D belong in the same row. 
(11) From column 37: W and Q belong in the same row. 
(12) From column 40: Q and V belong in the same row. 
It would be most fortunate and unusual for all these tentative deductions to be correct, for the 
disturbing effects of accidental adventitious repetitions have not been taken into account as 
yet. But let an attempt be made to assemble the data d!'duced thus far, to see if thL•y can all 
be reconciled. 
d. Tentative deduction (1) indicates that E, D, R, P, and X belong in the same column of 
the recomposition checkerboard. If correct, the complete set of 5 letters of one column is at 
hand. But tentative deduction (3) indicates that D and G belong in the same column and this 
would mean that the column has 6 letters, which is impossible. Further evidence will be re- 
quired to corroborate the hypothesis that E, D, R, P, and X are all actually in the same column, 
or that D and G are actually in the same column. For this purpose, further study must be made, 
and it is convenient to compile an "association table" showing how often certain letters are 
associated among themselves as prefixes to the repetitions. A similar association table is made 
for the suffixes. The tables may be combined in a manner similar to that shown in figure 83-, 
where the prefixes to repetitions appear at the left of the central alphabet, the suffixes to the 
right. 
Take column 1 of figure 82, having D, E, P, R, and X as prefixes to a long repetition. A stroke 
is placed in the E, P, R, and X cells of row D; a stroke. is placed in the P, R, and X cells of row E; 
a stroke is placed in the R and X cells of row P; and finally a stroke is placed in the X cell of row R. 
Again, take column 16 of figure 82, reading B H H H L. The B need not be considered, since it is 
not a prefix to the repetition beginning KI RX Y ... , but the Hand L may be considered. 
In the L cell of row H three strokes are inserted to indicate that H and L are associated that 
many times. Ea.ch time a datum is obtained, it is added to this table. Figure 83 shows the 
appearance of the table after all the data obtainable from the repetitions listed in subparagraph b 
have been inserted. From even this small amount of material a few deductions can be made. 
For example, it is seen that the B line of the table for prefixes shows 5 strokes at G and 3 strokes 
at W, from which it would appear that B, G, and W may be in the same column. The letters 
C and L likewise seem to be in the same column, as do Hand L, making C, H, and L appear to 
be in the same column. Studying the table of suffixes, it would appear that B and H are in the 
same row; I and Na.re in a row. After the entire text has been examined and the prefixes and 
suffixes distributed in this way, the whole table is studied carefully with a view to eliminating 
the effects of the accidental or pseudo-repetitious letters, trying to locate those letters which 
represent the prefixes and suffixes of true repetitions. 


A. 


B 
c 


D 


E 


F 


G 


!.· 
H 


.;). 


.~ ' 
I 


K 


~- 
': 
L 


M 


N 


0 


p 


Q 


R 
s 


T 
u 
v 
w 
x 


y 
z 


.. i,.t 


-·-----------------------.----------------------------------· 


PRE1''IXJ<..:S 


(fa?t.tcrs in same eolulDn) 


A. 
B 
C 
D E 
F 
G H 
I 
K L 
M N 0 
P 
Q R 
S 
T 
U V W X Y Z 


I 
A. 


------~ --------------Tl/--- B 


---Ti/----rr---~,----------,---1- c 
-----,---T!/----,--------,---71--711---,---'- D 


---------------,----,----------,--~E 


SU1''FIXES 


(Letters in same row) 


A B 
C D E 
F 
G H I 
K L 
M N 0 
P 
Q R 
S 
T 
U V W X 
Y Z 
I 
I I I 
I 
I 
I 
A 
.___, ___ 
/ ---~-71----------i----1-1-·1- 
B 


-----------------,-1-----T~-c 
'-------, ---------------1-/ ____ 
1_1_ D 


'------· -------------------·---!- 
E 
------------------------'- 
<-------------. -------------·-------- 
F 
F 
-------------------------'- 
G ---------,___----------,--,-----·- 
G 


,._ _________ '!llJ!t~-------------- H =========/ ===========1==1-1= H 
------------------~,-71---- 
I 
I 
'fl 
I 
II 
I 


'--------------, 
---------------------//// ,_ K '----------------------------------------·-- 


I 


K 
1---------------------------'- 
m 
m 


L =====================/ =-=i= L 
'-------------------------'- 
M 
M 
'----------------------------//!! ,_ N ---------------------Ti/ __ ,_ N 


0 
-----------------, 
-----------,--- p 


'------------------71-,------,-----1- Q 
---------------·---------------71-'- 
R 


1----------------------·------·---- 


~-----------------------'- 
.__ ________ 
.. ------------------------ 
/ 
I 
'----------~--------.------------'- 


0 


p 


Q 


R 


~-----------------71------s.___ _________________ r ________ s 


'--------------------------·-----!- 
1----------------------,---'- 
________________________ ,_ 


,____ ________________________ ,_ 


,__ ________________________ _ 


,___ ________________________ ,_ 


T 
u 
v 
w 
x 


,____ _______________________ 
, _ 


<-----------------------------· 
I 
,____ ______________________________ _ 


----------~-----------------·---- 
//! 
~ 


T 
u 
v 
w 
x 
'-------------------------------- 
1.----------------------------- 
y 
y 
________________________ 
,_ 
,____ _________________________ 
, _ 
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e. Suppose the data have been reduced to the following: 


Letters belonging In same columns 
Letters belonging In same rows 
( 1) 
D, G, U 
( 1) 
G, B, H, K 
(2) 
H, L, c 
( 2) 
I, W, N, L 
( 3-} 
Y, K, N 
( 3) 
D, C, A, s 
(4) 
W, Q, S, T, B 
(4) 
Q, V, X, Y, z 
( 5) 
T, u 
The presumption that Q, V, X, Y, and Z are all in the same row leads to the assumption that 
the mixing of the checkerboard is based upon a key word or key phrase. Following up this 
hypothesis, the data are assembled in the following manner: 


1 


';; 2 


! •· 
8. 
. 


El 3 
8 


5 


1 


w 
...._ 


T 


,_____ 


s -- 
B 
..___ 


Q 


2d component 
2 
3 
4 
5 


I 
L 
N 
-------- 
u 
-------- 
D 
c 
A 
-------- 
G 
H 
K 
-------- 
v x 
y 
z 


F'IOUBB 84. 


j. Only 6 letters remain to be placed in the checkerboard. But there are enough letters 


already placed t-0 warrant an immediate attempt at decipherment. For example, take the 
first few groups of message No. 2 and replace the letters by their bipartite equivalents: 


I 
w I 
L 
T 
G s 
I 
H w w A w K 
I 
N D 
12 
11 
12 
13 
21 
42 
31 
12 
43 
11 
11 
34 
11 
44 
12 
H 
32 
Recombining the bifid elements: 


.1 
21 
11 
21 
32 
14 
23 
11 
24 
31 
11 
13 
41 
14 
41 
21 
43 
2. 
Substituting by means of figure 84: 


.1 
21 
11 
21 
32 
14 
23 
11 
24 
31 
11 
13 
41 
H 
41 
21 
43 
2. 
T w T 
D N 
? w ? s w L 
B 
N B 
T 
H 


Obviously the decomposition and recomposition checkerboards are different. But the recon- 
struction of the former is not at all difficult, since the text is now in monoalphabetic form. The 
message begins with a group showing a repeated letter in the first and third positions: is the 
1st word E N E M Y? 
Probably it is, for message No. 1 also contains the sequence W I L T. 
At any rate, a transcription of the cryptograms into the bifid equivalents given by the nearly 
complete recomposition checkerboard (fig. 84) soon yields sufficient monoalphabetic text to 
permit of the complete reconstruction of both checkerboards: 


11 ! f 


11,;,; 
i l!i i 


2d component 


1 
2 
3 
4 
5 


1 
N u 
T 
y 
p 
- 
- 
- 
.. 2 
E 
0 
I 
F 
L 
~ 


~ 
- 
- 
- 


El 3 
A 
M B c s 
8 
- 
- 
- 


:= 4 
R w G 
D 
H 
- 
- 
- 
- 
5 
K 
Q v x z 


A 
(Decomposition) 
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F10URB 85. 


2d component 


1 
2 
3 
4 
5 


1 w I 
L 
N 
0 
- 
- 
- 
T 
u 
R 
E 
M 
- 
- 
- 
- 


S 
D C 
A F 


B 
G H K P 


5 
Q v x y z 


B 
(Recomposition) 


g. Speculating upon the key words ust•d to produce the mixed sequences in these checker- 
boards, the trade-name N U T Y P E (a typewriter cleaning fluid) suggests looking at the 
label on the box containing a. bottfo of this chemical. It reads: N U T Y P E 
N O N - 
I N F L A M M A B L E T Y P E C L E A N S E R , prepared by W A L T E R 
G · 
G I E S. 
This yields the sequence for the decomposition checkerboard. The legend 
on the box also reads: W I L L 
N 0 T I N J U R E M 0 S T D E L I C A T E 
F A B R I C S 
A N D 
F U R N I T U R E, which yields the sequence for the 
recomposition checkerboard. 


{.);, 


,:, 


' 
' 


'J 


~. 
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h. The two cryptograms may now be deciphered directly from the checkerboards. The 
plain-texts are as follows: 
No.1 
I S D C Y I W V E W D N B A X W S A V I W I L T K 
12 31 32 33 M 12 11 52 24 11 32 14 41 34 63 
11 31 34 52 12 11 12 13 21 44 


I T I S R E P 0 R T E D T H A T T H E E N E M Y H 
X L Y I W D A I N B D R W V R V S D D T N U L Q D 
63 13 M 12 11 32 34 12 H 41 32 23 11 52 23 52 31 32 32 21 
14 22 13 61 32 
A s·R ET IRED T 0 AP 0 SIT I 0 NW EST 0 
U B I N R K V L Q D N L Q D T V T I N I N D C U W 
22 41 12 14 23 44 52 13 51 32 14 13 61 32 21 52 21 12 14 12 H 32 33 22 11 
F N E W C H E S T E R S T 0 P 0 N E R E G I M E N 
W D C V S 0 D C G S I S S G U H K I R X Y I R N G 
11 32 33 52 31 16 32 33 42 31 12 31 31 42 22 43 44 12 23 53 M 12 23 14 42 
T I S I N V I C I N I T Y 0 F C R 0 S S R 0 A D 0 
T I W A U U I A A Q C W N B I E W A Y U L Q S A V 
21 12 11 34 22 22 12 34 34 61 33 11 14 41 12 24 11 34 54 22 13 51 31 34 52 
NETWOEIGHTANDNORTHWESTTHE 
N I I U H Q D T X W I T A V N N I N D C U W W C G 
14 12 12 22 43 51 32 21 63 11 12 21 34 52 H 14 12 H 32 33 22 11 11 33 42 
R E 0 F S T 0 P A N 0 T H E R R E G I M E N T C 0 
T L G W W A L W D S N S I L N N I R N G S T L B D 
n 
ra 42 11 11 34 IB 11 32 n H n n IB 14 14 n 23 H 42 n n 
ra il 32 
N C E N T R A T I N G N E A R R 0 A D J U N C T I 
D T W A U U I A A Q D G T E L Q D T X D W Y I W X 
32 21 11 34 22 22 12 34 34 51 32 42 21 24 13 51 32 21 63 32 11 54 12 11 63 
0 N T W 0 E I G H T F 0 U R S T 0 P B E P R E P A 
N I N B D R Q T Q V E W C W S C L P I T L K I R X 
14 12 14 41 32 23 51 21 51 52 24 11 33 11 31 33 13 45 12 21 13 " 
12 23 53 
R E D T 0 S U P P 0 R T A T T A C K 0 N C R 0 S S 
Y I R N G T I W A U U I A A Q C Q D T Z I I W V T 
54 12 23 H 42 21 12 11 34 22 22 12 34 34 61 33 Iii 32 21 55 12 12 11 52 21 
R 0 A D 0 N E T W 0 E I G H T S T 0 P K E E P 0 N 
I N I N D C U W W D S N I L V N 0 D L Q D T X W S 
12 14 12 14 32 33 22 11 11 32 31 14 12 13 112 14 111 32 13 111 32 n 
113 11 31 
EREGIMENTINRESERVESTOPATT 
CLPWVRVSDDTNULQDUHKIRXYIR 
33IB4511522352fil3232n1422IBM32224344H2363MH23 
A C K P 0 S I T I 0 N W E S T 0 F C R 0 S S R 0 A 
N G T I W A U U I A A Q C Q D T V 
H42nH11342222H3434M33M32n52 
D 0 N E T W 0 E I G H T S T 0 P 
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No. 2 
I W I L T G S I H W W A W K I N D C U W W A X L X 
12 11 12 13 21 42 31 12 43 11 11 34 11 44 12 14 32 33 22 11 11 34 53 13 53 
E N E M Y I N F A N T R Y R E G I M E N T H A S B 
D I W I R C V N 0 D N G S L N G I G W L V F D W V 
32 12 11 12 23 33 52 14 15 32 14 42 31 13 14 42 12 42 11 13 52 35 32 11 52 
E E N 0 B S E R V E D I N A D E F E N S I V E P 0 


R V S D D T I L L Q D U K D W S S H X S E N C Q D 
23 52 31 32 32 21 12 13 13 51 32 22 44 32 11 31 31 43 53 31 24 14 33 51 32 
S I T I 0 N E A S T 0 F G E T T Y S B U R G S T 0 
T Q G T E U D V Q C 0 I W T X W V R V S D D T N U 
21 
51 42 21 24 22 32 52 51 33 15 12 11 21 53 11 52 23 52 31 32 32 21 14 22 


P Y 0 U W I L L T A K E U P A P 0 S I T I 0 N W E 
L Q D U H K I R X Y I R N B A Y I I I G T E W A Y 
13 51 32 22 43 44 12 23 53 54 12 23 14 41 34 54 12 12 12 42 21 24 
11 34 54 
S T 0 F C R 0 S S R 0 A D T H R E E F 0 U R T H R 
I I L W N K I R N G S T L B D D T I T I L U D V L 
U 
U g 
11 14 44 U 
23 14 U 
M 21 g il ~ ~ 21 U 
21 U 
g 
22 
~ 52 g 


E E A N D R 0 A D J U N C T I 0 N 0 N E M I L E S 


V T T A Q A V N I I U H Q D T X D W Y I W X N I N 
52 21 
21 34 51 34 52 14 12 12 22 43 
51 32 21 53 32 11 54 12 11 53 14 12 14 
0 U T H T H E R E 0 F S T 0 P B E P R E P A R E D 
B D R W S C L P L W A H N T L Q D T X C W S C I V 
41 32 23 11 31 33 13 45 
13 11 34 13 24 11 53 51 32 21 53 33 11 31 33 12 52 
T 0 A T T A C K A T D A W N S T 0 P B A T T A L I 
D T N I L V N 0 D N U L Q D U B G T E W V R V S D 
32 21 
14 12 13 52 14 
15 32 14 22 13 51 32 22 41 42 21 24 
11 52 23 52 31 32 


0 N R E S E R V E W E S T 0 F Y 0 U R P 0 S I T I 
D T W 
32 21 
11 


0 N 


48. Special solution.-a. The preceding example of solution constitutes the general solution 
for this system, since no special conditions are prerequisite to the procedure set forth. 
An 
interesting solution, however, is that wherein the same message has been cryptographed by two 
different sets of checkerboards. 
b. Suppose, for instance, that in this system two cryptograms of identical lengths and plain 
texts but different cryptographic texts are available for examination. They are superimposed 
and appear as follows: 
No. 1. G C 0 D M G C E G B W I L W G M 0 N G B S X 0 P C N G E S F L N I 
No.2. WILT GS I H WW AW KIND CU WW AX L X DI WI RC V N 0 


No. 1. W T M G E T L N C G F M D W G X H M G A T A C T 0 M S W B L G A I 
No. 2. D N G S L N G I G W L V F D W V R V S D D T I L L Q D U K D W S S 


No. 1. Q P F U A Q M S A Z P H Z G N L M S 0 W 0 V X G X H M G A T A K N 
No.2. H XS ENC Q D T Q GTE U D V QC 0 I WT X WV RVS DDT NU 


No. 1. 0 M S W C U S H Q L S S T M S U W N N E H U A S U W N T G E L S S 
No.2. L Q DUH KI RX YI RN BAY I I I GTE WAY I IL W N KI R 


No. 1. T M 0 V C V A T A E A C 0 G N L 0 P H V S V S U N W T W F M S A X 
No.2. NG ST LB DDT IT IL U D V L VT QA QA V NI I UH Q D TX 


lt'IRS'l' COMPONEN'l'H OF Cll.YP1'0GH.AM No. l 


A 
B 
c 
D 
E 
F 
G 
H 
I 
K 
L 
II 
N 
0 
p 
Q 
R 
s 
T 
u 
v 
I 
:x: 
y 
z 


A - -- 
-- - 
[~;g 
I T,I, I -I - ! I s,s, I ~~~ 1 ___ - 
- _I_ - 
_I ___ J --~- ----. 
=~: D.01--·---------·-·-·--· -~~: ·-- _T1Q1 
: ------·--- ·--·-------- f i,ii, - - ---c.w;-1_ 
__11_ - 
---+~--- -0.1, I.L. ---- -- 
~~ ---H;K--;--L,B, : 
------- 


o 
1---------------r---- -· ·- --- ~~----· -· r--- -· -- -- 
·- i-·----- -T1G1 ·--N1U1 -- --- -- --·-- 
F1D1 
·----· ..___ 


E --I~T1- --·-···· ··--··--·--·---- -··- --·-.-·-·--···-H;w;--G;T;··r-·--·--- ... ---N"~;·-----------···- -·------ 
I.R.1 I.N1 
,.... __ _ 


__ __L ______ ··----·-·------~!~!-. ---··-- ---·- ------ 


'1 
C1V1 
I.Vi 
H.Q1 


I 
! 
I.Qi 
·- 
W1I1 
w.i:~--·-· ··--.----·------- N.01 
u.o·-1-1---~---I--- ---l--,•=IA-:--1 -1---l-,1=.-=y=--I t-------W1V1 


SaL1 
TaL1 
WtX1 
WsN1 


F 
--- ___________ ,______ s.s:-;-.-- 


H 
---- . -·-- -----1---1----+---1---R.-V-1-1----------------· -- 
R.X~------- 
T.E1 
... . ---1------------"'·· .. ---·--·----,..-------~·-I--~-- 1-=~-1---~---1----i----+---t--:::-=-1--- 


~ I 
s.H1 
---1---1---'1 0.01 
r 
----: =;=~1-_------v~--~; y~ -B,G;=~--~~----=.=--==~~1-:~~.~~~:=f----1-----1----+~....,X.~~-:1~1~~~:~--=~--:~_-=~--~~:~~-- 


... 
V1F I 
Gt81 
I 
O.C1 
QwD1 --v.01 ,_ 
i :--·--· --- I1G1 -- 
I,G,. 
: 
NA_I 
-D;v, r.v, r.1, -: ---i---+-·---~-c;_ IaL1 _____ ,_l\I1----~,,-,,,-i--- 


-- 
-- 


~ 
~ 
c 
:z: 0 ,___ _________ Li.Ti 
L.U1 
·--··-- 
I.Vi 
I.Qi 
C1U1·-1---i-I.X---,--1-i-----------t-----.-1-T1- 0.11 


I.Pi 


f 
~ 
~ 
~ p 
-- X.01 -iiaN1 -- X.S1 - 
GaT1----1---1-----'1---1---------_;_1--+---1----·--1---~---1----1----1---+---1 
u 
V1T1 
---1---1---r---i----;---1--1--------1--==-=--~.,,,.....,,-~---1---~=---•--+---t----1f----1----1---1----~--1---+---~ 
~Q 
~ ~ 
~ 
0 
~ 
1--- 
1---------------~----::--·=---~-~~---1---~--l---1---1--~11---1-----1---1-----~--+---1----~--1----1 
iil13 R 
iZl 


C:aLi 
C101 
A.Hi 
I.R.1 
R.Ni 
A.Yi 
A.Qi 
O.U1 
AJ.1 
C.I1 
D.Ri 
A.Vi 
N1Gi 
N1Gi 
I.Li 
I1Ui 
N.B1 
VsN1 
X.I1 
Y1I1 


- 
Q.!1 
T.:X:i 
-- 
o.N1 
I1I1 
I1Ni 


y ... --- -·- ------1----1------ ------·1---1---~---1----+---l·--+---1--- 
P:aLi 


z 
~ 


J'JaVAll. 
llllUll-41 (1'1111 p. 11'1) 


Ill 
~ 
0 
!ii!I 
t:I 
8 
IC 
(! 
!ii!I 
l!!I 
!ii!I ;a 


~ 
0 
!: 
"II 
~ 
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~ 
~ 
IC 


~ 
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No. 1. C G U W G X N W T M S S G A S N Y S G S P D G F M S A X E G A S N 
No.2. D WY I W X NIN B DR W SC LPL WAHN TL Q D TX CW SC I 


No. 1. M T A C W 0 L N I W D N 0 M S W K P H U A X H M G A T A C 
No.2. VDT NIL V N 0 D NU L Q DUB GTE WV RVS DDT I 


c. Now consider the first few superimposed letters in these two cryptograms: 


No. L---------- G C 0 D M G C E G . . . 
No. 2----------- W I L T G S I H W . . . 
Take the pair of superimposed letters GW. 
The G is the cipher resultant of the recombination of 
two bipartite numerical components that apply to the recomposition checkerboard. The actual 
identities of these numerical components are not known, but, whatever they be, the first of 
them determines the first half of Ge, the second determines the second half of G0 • 
Therefore, for 
cryptanalytic purposes, the actual, but unknown; numerical components may be represented 
by the symbols G1 and G2, the former referring to the row coordinate of the recomposition checker- 
board, the latter to the column coordinate. What has been said of the letter G applies also to 
the letter W, the equivalent of Gin another checkerboard. It will be fowid that this manner of 
designating bipartite components by means of subscripts to the letters themselves is a very 
useful method of handling the letters. 
d. Let the first few letters of the two cryptograms be replaced by these same cipher letters 
with their subscripts to indicate components. Thus: 
No. !______________ 
C 
G 
C 
0 
Components ____ C1C2 
No. 2______________ I 
Components____ I1I2 


D 
M 
c 


Now from the method of encipherment it is clear that C2Q1 and I2W1 represent the same plain-text 
letter, since both messages are assumed to contain identical plain texts. That is, C2G1 of crypto- 
gram No. l=I2W1 of cryptogram No. 2. 
Likewise G2C1=W2I2; C201=I2L1; 02D1=L2T1; and so on. 
e. Let all the component pairs of the cryptograms be equated in this manner and let these 
pairs be distributed in a table, such as that shown ill figure 86. It will be seen in figure 86 that, 
for example, A2C1 of cryptogram No. l=T2I1 and T2N1 of cryptogram No. 2. This means that 
I 1 and N1 must represent the same row coordinate of the recomposition checkerboard for crypto- 
gram No. 2; in other words I and N must be in the same row in that checkerboard. Again, in figure 
86, it is seen that C2G1 =G2W1 and D2Wi, which means that G and D must be in the same column in 
that checkerboard. Again, A2Si=W2A1=S2C1; this means that A and C are in the same row, W 
and S, in the same column, in the recomposition checkerboard for cryptogram No. 2. All these 
data in figure 86 are studied with the following results: 
In same row: 
In same column: 
(1) I, N, L, w 
(1) 
(2) 
(3) 
(4) 
(5) 
(2) A, C, S, D 
T 
H 
y 
Q 
u 
(3) Q, v, x, y 
w 
c 
K 
B 
I 
(4) B, G 
s 
L 
D 
R 
G v 


3241511----41~11 
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An attempt is now made to bring together these results to reconstruct the recomposition checker- 
board for message No. 2. 
This yields the following: 


2d Component 


u K? R T K? 
,__ - 
- 
- 
,_ 
I N 
L w K? 
- 
- 
- -- - 
D A c s K? 
- 
- 
- 
- 
-- 
G K? H B K? 
- 
- 
- 
- 
- 
v Y? x Q Y? 


FIOUBE86a, 


Compare this with the recomposition checkerboard shown in figure 85 (B). Enough has been 
shown to illustrate the procedure. If there WC're just a little more text, probably all 25 letters 
of the checkerboard could be definitely placed. 
J. By making a reciprocal table for equivalencies between component pairs in cryptogram 
No. 2, the data obtained would permit of reconstructing the recomposition checkerboard for 
cryptogram No. 1. 
Having these checkerboards completely or at least partially reconstructed, 
the reconstruction of the decomposition checkerboards is a relatively easy matter and follows 
the procedure described in paragraph 4 7j. 
· 


g. The complete solution oi the two cryptograms, including the decomposition and recom- 
position matrices, is as follows: 


1 


i 2 
l 
~ 3 
! 4 


5 


No. 1 
2d Component 
2d Component 


1 
2 
3 
4 
5 
1 
2 
3 
4 
5 


1 
w A s 
H 
I 
- 
- 
- 
- 
R ~1~·_:_ c 


T 
I 
N 
G 
p 
'ii 2 
N 
G 
T 
0 
D 
., = 
- 
- 
- 
- 
8. 3 
c 
B 
E 
F 
K 
~ 


,__ - 
- 
- 
- 


0 
A 
B 
D 
H 


~ 
- 
- 
- 
- 
t.J 
- 
- 
- 
K 
M 
Q s u 
J!l 4 
L 
M 
p 
Q R 
--- 
- 
5 
u v x 
y z 
---,- 


- 
v w x y z 
A 
B 
(Decomposition) 
(Recomposition) 
G C 0 D M G C E G B W I L W G M 0 N G B S X 0 P C N G E S F 
22 81 24 25 42 22 31 38 22 32 11 16 41 11 22 42 24 21 22 32 13 53 24 43 31 
21 22 33 13 34 
ENEMYINFANTRYREGIMENTHASBEENOB 
LNIWTMGETLNCGFMDWGXHMGATACTOMS 
41 21 15 11 23 42 22 33 23 u 
21 31 22 34 42 25 11 22 53 14 42 22 12 23 12 31 23 24 42 13 
SERVEDINADEFENSIVEPOSITIONEAST 


W B L G A I Q P F U A Q M S A Z P H Z G N L M S 0 W 0 V X 0 
11 32 41 22 12 15 44 43 34 61 12 44 42 13 12 55 43 14 5S 22 21 41 42 13 24 11 24 52 53 22 
0 F G E T T Y S B U R G S T 0 P Y 0 U W I L L T A K E U P A 
XHMGATAKNOMSWCUSHQLSSTMSUWNNEH 
53 14 42 21 12 23 12 35 21 24 42 13 11 31 51 13 14 44 41 13 13 23 42 13 51 11 21 
21 33 14 
P 0 S I T I 0 N W E S T 0 F C R 0 S S R 0 A D T H R E E F 0 


J - 
' 
; 


·.·< 


·~· 


!'" •. 
.<'" 


.~-i. 


··~i·" 
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UASUWNTGELSSTMOVCVATAEACOGNLOP 
51 12 13 61 11 21 23 22 33 41 13 13 23 42 24 52 31 62 12 23 12 33 12 31 24 22 21 41 24 43 
URTHREEANDROADJUNCTIONONEMILES 
HVSVSUNWTWFMSAXCGUWGXNWTMSSGAS 
14 52 13 52 13 61 21 11 23 11 34 42 13 12 53 31 22 61 11 22 53 21 11 23 42 13 13 22 12 18 
OUTHTHEREOFSTOPBEPREPAREDTOATT 
NYSGSPDGFMSAXEGASNMTACWOLNIWDN 
UMU2218432522U421812533322Hl8U4223UM1124UUU1125U 
A C K A T D A W N S T 0 P B A T T A L I 0 N R E S E R V E W 
OMSWKPHUAXHMGATAC 
24 42 13 11 36 43 14 51 12 53 14 42 22 12 23 12 
31 
E S T 0 F Y 0 U R P 0 S I T I 0 N 


1 


1i 2 
l e a 
0 
! 4 


5 


No. 2 
2d Component 


1 
2 
3 
4 
5 


N u 
T 
y 
p 
- 
- 
- 
- 
,_ 


E 
0 
I 
F 
L 
,__ - 
- 
- 
,_ 


A 
M B c s 
- 
- 
- 
- 
,_ 
R w G 
D 
H 
- 
- 
- 
- 
- 
K 
Q v x z 


2d Component 


1 
2 
3 
4 
5 


1 
w I 
L 
N 
0 
- 
- 
- 
- 
- 
T u 
R 
E 
M 
,_ - 
- 
- 
- 
s 
D c 
A 
F 
- 
- 
- 
- 
,_ 
B 
G 
H 
K 
p 
- 
- 
- 
- 
,_ 
5 
Q v x 
y z 


W I L T G S I H W W A W K I N D C U W W A X L X D I W I R C 
11 12 18 21 42 31 12 43 11 11 34 11 44 12 14 32 33 22 11 11 34 53 13 53 32 12 11 12 23 33 
ENEMYINFANTRYREGIMENTHASBEENOB 
V N 0 D N G S L N G I G W L V F D W V R V S D D T I L L Q D 
5214U321442fill814421242111852~3211522352M3232U121818M32 
SERVEDINADEFENSIVEPOSITIONEAST 
U K D W S S H X S E N C Q D T Q C T E U D V Q C 0 I W T X W 
22 44 32 11 41 31 43 53 31 24 14 33 61 32 21 51 42 21 24 22 32 52 51 33 15 12 11 21 53 11 
0 F G E T T Y S B U R G S T 0 P Y 0 U W I L L T A K E U P A 
VRVSDDTNULQDUHKIRXYIRNBAYIIIGT 
522352M3232Ul42218M32224344122353M122314il34M12121242U 
P 0 S I T I 0 N W E S T 0 F C R 0 S S R 0 A D T H R E E F 0 
E W A Y I I L W N K I R N G S T L B D D T I T I L U D V L V 
24 11 34 M 12 12 13 11 14 44 12 23 H 42 81 21 13 U 32 32 21 12 21 12 13 22 32 52 13 52 
URTHREEANDROADJUNCTIONONEMILES 
TTAQAVNIIUHQDTXDWYIWXNINBDRWSC 
UU34M3452H12122243M32U533211M121153H12HU322311M33 
0 U T H T H E R E 0 F S T 0 P B E P R E P A. R E D T 0 A T T 
LPLWAHNTLQDTXCWSCIVDTNILVNODNU 
13 45 13 11 34 13 24 11 53 51 32 21 53 33 11 31 33 12 52 82 21 14 12 13 52 14 u 33 14 22 
A C K A T D A W N S T 0 P B A T T A L I 0 N R E S E R V E W . 
LQDUBGTEWVRVSDDTW. 
18MU22U42UU11522352MU32UU 
E S T 0 F Y 0 U R P 0 S I T I 0 N 


~ : 
.i 
:[ 
l 
' 


l 


'\ 


; 


Jl 
r: 


j: 
'· 
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h. It is seen that the principles elucidated permit of solving this fairly good cipher system 
without recourse to frequency studies and detailed, difficult analytical research. What can be 
done with complete messages of identical texts will give the student a clue to what might be done 
when fairly lengthy sequences of identical plain texts (but not complete messages) are available 
for study. Messages with similar beginnings, or similar endings will afford data for such 
reconstruction. 
49. Periodic fractionating systems.-a. Another type of combined substitution-transposition 
system involving fractionation is that in which the processes involved are applit1d to groupings 
of fixed length, so that the system gives external evidence of periodicity. One such system, 
commonly attributed to the French cryptographer Dclastelle, is exemplified below. Let the 
bipartite alphabet be based upon the 25-cell substitution checkerboard shown in figure 80. 
Let the message to be enciphered be ONE PLANE REPORTED LOST AT SEA. 
Let it also be 
assumed that by preagreement between correspondents, periods of 5 letters will constitute the 
units of encipherment. The bipartite equivalents of the plain-text letters are set down vertically 
below the letters. Thus: 


2'I component 


1 
2 
3 
4 
5 


1 
M 
A 
N u 
F 
- 
- 
- 


ii2 c 
T 
R 
I 
G 


~ 
- 
- 
--- 
h 
B 
D 
E 
H 
K 


" " 
- 
- 
- 
- 
:!4 
L 
0 
p 
Q s 


5 v w x 
y 
z 


FIGURE 87. 


0 N E P L 
ANERE 
P 0 R T E 
D L 0 S T 
ATS EA 
41344 
11323 
44223 
34442 
12431 
23331 
23333 
32323 
21252 
22632 
Recombinations are effected horizontally within the periods, by joining components in pairs, 
the first period yielding the pairs 41, 34, 42, 33, 31. These pairs are then replaced by letters 
from the original checkerboard, yielding the following: 


0 N E P L 
A N E R E 
P 0 R T E 
D L 0 S T 
A T S E A 


4 
I 
3 
4 
4 
2 
3 
3 
3 
I 
L H 0 EB 


l 
l 
3 
2 
3 
2 
3 
3 
3 
3 
MDDEE 


4 
4 
2 
2 
3 


3 
2 
3 
2 
3 
QT ERR 


3 
4 
4 
4 
2 
2 
l 
2 
5 
2 
HQ TA W 


I 
2 
4 
3 
l 
2 
2 
5 
3 
2 
A P A G D 


b. A different checkerboard may, of course, be employed for the recomposition process. 
Also, periods of any convcniep.t length may be employed; or, in a complicated case, periods of 
varying lengths may be employed in the same cryptogram,·according to some prearranged key. 


60. General principles underlying the solution.-a. It will be noted that the periods in the 
foregoing example contain an odd number of letters. The result of adopting odd-length periods 
is to impart a much greater degree of cryptographic security to the system than is the case when 
even-length periods are involved. This point is worth while elaborating upon to make its crypt. 
analytic significance perfectly clear. 
Note what happens when an even period is employed: 


ONEPLA 
NEREPO 
RTEDLO 
4134.41 
2 
3 
3 
3 
1 
2 
LHLREA 


1 
3 
2 
3 
4 
4 
3 
3 
3 
3 
3 
2 
NRQEED 
223344 
323212 
TEQDDA 


~· 
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Now if each 6-letter cipher group is split in the middle into two sections and the letters are taken 
alternately from each section (Ex. L H L R E A=L R H E L A) the results are exactly the 


M 
A 
N u 
F 
same as would be obtained in case a simple digraphic enciphermentwere 
to be employed with the 2-square checkerboard shown in figure 88. 
For example, ONp=LRe; EPp=HEc1 and so on. Encipherment of this 
sort brings about a fixed relationship between the plain-t.<'xt. digraphs 
~- -~- -·~- _r___ G 
and their cipher equivalents, so that the solution of a m<1ss11ge of this 
B 
D 
E 
H 
K 
type falls under the category of th<1 cryptmmlysis of u case bf simpl<' 
- 
---···· --·-- -- - - 
digraphic substitution, once the length of t.lw p<>riod has been estab- 
L 
0 
P 
Q S 


lished.3 
The latter step can readily be accomplished, as will be seen 
presently. In brief, then, it may be said that in this system when 
encipherment is based upon even periods the cipher text is purely 
and simply digraphic in character, each plain-text digraph having 
one and only one cipher-text digraph as its equivalent. 
b. But the latter statement is no longer true in the case of odd 
periods. Note, in the example under paragraph 49a, that the cipher 


v 


M 


A 


N 


w 
c 


T 


R 


x y z 


B 
L v 


D 
0 
w 


E 
p 
x 


equivalent of the first plain-text digraph of the first group, ON, is 
u 
I 
H 
Q y 
composed of the initial and final components of the letter Lo, the 
- 
------ 


fine.I component of the letter 0 0 , and the initial component of the 
F 
G 
K 
S 
Z 


letter Le. That is, three different plain-text letters, L, 0, and E, are ON EP L'A NE 
involved in the composition of the cipher equivalent of one plain-text 
digraph, ON. 
Observe now, in the following examples, that variants L R H E 
L A N E 


FIGURE 88. 
may be produced for the digraph ONp. 


l 2 
3 4 
Ii 
I 2 34 
II 
1 2 
3 4 
Ii 
1 2 
3 4 
5 
1 2 
3 4 
II 
1 2 
3 4 
II 
1 2 
34 " 
ON EP L 
ON TH E 
ON CR U 
PR ON G 
CO NT I 
PO NG I 
AT IQ_Jf 
TI 3 4 
4 
TI 2 3 
3 
IT 22 
I 
4 2 TI 2 
2412 2 
4Tl2 2 
1 2 
2 4 
1 
23 
3 3 1 
2 3 
24 
3 
23 
I 3 
4 
3 3 
2 3 
6 
1 2 
3 2 
4 
3 2 
3 5 
4 
2 2 
4 2 
3 


~OE B 
l!R DD P 
l!T AB H 
01:! RD K 
IA CR I 
.QA RH y 
AI AI B 


(1) 
(2) 
(3) 
(4) 
(5) 
(6) 
(7) 


c. The foregoing examples fall into two classes. In, the first, where the 0 of ONp falls in an 
odd position in the period, the :first letter of the trigraphic cipher equivalent must be an La, the 
second must be one of the 5 letters in the second column of the substitution checkerboard, the 
third must be one of the 5 letters in the third row of the checkerboard. Therefore, Le may 
combine with 5 X 5 or 25 pairs of letters to form the second and third letters of the 3-letter equiva- 
lent of ONP. In the other class, where the 0 of ONp falls in an even position in the period, the 
first letter of the equivalent must be one of the 5 letters in the fourth column of the checkerboard, 
the second must be one of the 5 letters in the first row, and the third letter must be Re. 
There- 
fore, Ro may combine with 5X5 or 25 pairs of letters to form the first and second letters of the 
3-letter equivalent of ONP in this position in the period. Hence, ONp may be represented by 50 
trigraphic combinations; the same is true of e.11 other plain-text digraphs. Now if the system 
based upon even periods is considered as a simple digraphic substitution, the foregoing remarks 
lead to characterizing the system based upon odd periods as a specie.I tYPe of digraphic sub- 
stitution with variants, in which 3 letters represent 2 plain-text letters. 


1 An example of the solution of a cryptogram of this type was given in Military Cryptanalysia, Part I, 
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d. However, further study of the odd-period system may show that there is no necessity for 
trying to handle it as a digra.phic system with variants, which would be a rather complex affair. 
Perhaps the matter can be simplified. Referring age.in to the example of encipherment in 
pa.re.graph 49 a: 


0 N E P L 
4 
1 
3 
4 
4 


2 
3 
3 
3 
1 
L H 0 EB 


AN ERE 
1 
1 
3 
11 
3 
2 
3 
3 
3 
3 
MD DEE 


P 0 R T E 
4 
4 
2 
2 
3 
3 
2 
3 
2 
3 
QT ERR 


D L 0 S T 
3 
4 
4 
4 
2 
2 
1 
2 
5 
2 
HQ TA W 


ATS EA 
l 
2 
4 
3 
1 
2 
2 
5 
3 
2 
AP AG D 
Now suppose that only the cipher letters are at hand, and that the period is known. The first 
cipher letter is L, and it is composed of two numerical bifid components that come from the first 
and second positions in the upper row of components in the period. These components are not 
known, but whatever they are the first of them is the first component of L the second of them 
is the ~econd component of L. 
Therefore, just as in paragraph 48c, the ~ctual but unknown, 
numenca.l components may be represented by the symbols L1 and L2, the former referring to the 
row coordinate of the substitution checkerboard, the latter to the column coordinate. The 
same thing may be done with the components of the second cipher letter, the third, fourth, and 
fifth, the respective components being placed into their proper positions in the period. Thus: 


Cipher----------------------- L 
H 
0 
E 
B 
Components _______________ { L i L 2 H i H 2 0 i 
02E1E2B1B2 


Now let the actual plain-text letters be set into position, as shown at the right in the two dia- 
grams below. 
Plain text___________________ 0 
N E 
P L 
0 
N E 
P 
L 


Components _______________ {: 


Cipher_______________________ L 


1 
3 
4 
4 
3 
3 
3 
1 
H 0 
E B 


L1L2H1H201 
02E1E2B1B2 
L 
H 
0 
E 
B 


C 
ts 
{ 
k~~~~ ~~~~~ ~~~~~ ~~~~~ ~~~~~ 


omponen --------- 
:-Os""":":E ... 
1 ":'Es;;..B=-1 Bs~~~~E~1:..E~2:.E~1;..Es~_.;E;;;;2:..;R~1:.;R:.;:2:..;R:.;:1:.;R;_;2:__T,:;2:..;A::.1!..:A::.2:..W;.;.1:,.W:;.;,2~..;A:;2:.,G:::,1:,.Gs:::.;D::,1~D~2 


Cipher __________________ L H 0 E B 
M D D E E 
Q T E R R 
H Q T A W 
A P A G D 
J. -Note that a plain-text letter in an odd position in the period has its components in the order 


0102; in an even position in the period the components of a pie.in-text letter are in the order 0201. 


For example, note the OP in the first period ( =~~) and the OP in the -third period ( =~:} This 


distinction must be retained since the component indicators for rows and columns are not inter- 
changeable in this system. From this it follows that the vertical pairs of components represent- 


J'. 
:·. 


·-:...: 
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in.g a given plain-text letter are of two classes: 0 102 and 020i, and the two must be kept separate 
in cryptanalysis. 


g. Now consider the equivalent of OP in the first period. It is composed of ~ 
1 
• 
This is 


- 
2 


only one of a number of equivalents for OP in an odd position in the period. The row of the sub-' 
_ stitution checkerboard indicated by L1 may be rcprPsented by 4 other components, since that 


row contains 5 letters. Therefore th" uppC'r eomporwnt of tlw :: PquivalPnt of OP mny he• 1my 


one of 5 letters. The same is true of the lowpr eomponent. Hence, 011 in an odd position in the 
period may be represented by any one of 5X5=25 combinations of vertical components in the 
sequence 0c-~02 • 
OP in an even position in the period may be represented by any one of a similar 
number of combinations of vertical components in the reverse sequence, 02~81. Thus, dis- 
regarding the position in the period, this system may be described as a monoa.lphabetic sub- 
stitution with variants, in which every plain-text letter may be represented by any one of 50 
different component-pairs. But in studying an actual cryptogram in this system, since the 
position (odd or even) occupied by a cipher letter in the period is obvious after the length of the 
period has been established, a. proper segregation of the cipher letters will permit of handling the 
cipher letters in the two classes referred to above, in which case one has to deal with only 25 
variants for each plain-text letter. Obviously, the 25 variants a.re related to one another by 
virtue of their having been produced from a single enciphering matrix of but 25 letters. This 
relationship can be used to good advantage in reconstructing the matrix in the COUrBl' ·of the 
solution and the relationship will be discussed in its proper place. 


h. Now if the foregoing encipherment is studied intently several important phenomena may 


be observed. Note, for instance, how many times either the 01 or the 02 component coincides 
with the plain-text letter of which it is a pa.rt. In the very first period the Op has an 02 under it; 
in the same period the Ep has an E2 under it. The same phenomenon is observed in columns 
3 and 5 of the second period, in column 3 of the third period, and in column 1 of the fifth period. 
In column .5 of the third, fourth, and fifth periods the 0 1 components coincide with the respec- 
tive plain-text letters involved. There a.re, in this short example, 9 cases of this sort, giving 
rise to instances of what seems to be a sort of self-encipherment of plain-text letters. How does 
this come a.bout? And is it an accident that all these cases involve plain-text letters in odd 
positions in the periods? 
i. If the periods in the foregoing example in subparagraph e are studied closely, the following 
observations may be ma.de. Because of the mechanics of encipherment in this system the first 
cipher letter and the first pie.in-text letter in each period must come from the same row in the 
substitution checkerboard. Since there are only 5 lctters in a row in the checkerboard the proba- 
bility that the two letters referred to will be identical is 1/5. (The identity will occur every time 
that the coordinate of the row in which the second plain-text letter stands in the checkerboard is 
the same as the coordinate of the column in which the first plain-text letter stands.) The same 
general remark applies- to the second cipher letter and the third plain-text letter; as well as to 
the third cipher letter and the fifth plain-text letter: In these cases the two letters must come 
from the same row in the checkerboard and the probability that they will be identical is likewise 
1/5. 
(The identity in the former case will occur every time that the coordinate of the row in 
which the fourth plain-text letter stands in the checkerboard is the same as that of the column 
in which the third plain-text letter stands; in the latter case the identity will occur every time 
that the coordinate of the column in which the first pie.in-text letter stands is the same as that 
of the column in which the fifth plain-text letter stands.) The last of the foregoing sources of 
identity is exemplified in only 4 of the 9 cases mentioned in subparagraph h above. These 


I 1 
I. I I 
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involve the fifth plain-text letter in the third, fourth, and fifth periods, and the first letter in the 
fifth period, wherein it will be noted that the 01 component standing directly under the plain- 
text letter is identical with the latter in ea.ch case. 
j. But how a.re the other 5 cases of identity brought about? Analysis along the same 
lines as indicated above will be omitted. It will be sufficient to observe that in ea.ch of those 
cases it is the 02 component which is identical with the plain-text letter involved, and a.gain the 
probability of the occurrence of the phenomenon in question is 1/5. 
k. Since the probability of the occurrence of the evmt in question is 1/5 for 01 components 


and 1/5 for 02 components, the total probability from either source of identity is 2/5. This 
probability applies only to the letters occupying odd positions in the period, and it may be said 
that in 40 percmt of all cases of letters in odd positions in the periods the one or the other of the 
two cipher components will be identical with the plain-text letter. 
l. As regards the plain-text letters in even positions, analysis will show why only in a very 
few cases will either of the cipher components coincide with the plain-text letter to which they 
apply, for the method of .finding equivalents in the substitution checkerboard is to take the 
first component as the row coordinate indicator and the second component as the column indi- 
cator; a reversal of this order will give wholly different letters, except in those 5 cases in which 
both components are identical. 
(The letters involved are those which occupy the 5 cells along 
the diagonal from the upper left-hand corner to the lower right-hand corner of the checkerboard.) 
Now in every cuse of a letter in an odd position in a period the two vertical components a.re in 
the 0102 order, corresponding to the order in which they are normally taken in finding letter 
equivalents in the checkerboard. But in every case of a letter in an even position in a period, 
the two vertical components are in the order 0201J which is a reversal of the normal order. It 
has been seen that in the ca.se of letters in odd positions in the periods the probability that one 
of the components will coincide with the plain-text letter is 40 percent. The reasoning which led 
to this determination in the case of the odd letters is exactly the same as that in the case of letters 
in even positions, except that in the final recomposition process, since the components in the 
even positions are in the 0201 order, which is the reverse of the normal order, identity between 
one of the components and the plain-text letter can occur in only 1/5 of the 40 = 8 percent of 
the cases. It may be said then that in this system 48 percent of all the letters of the plain text 
will be "self-enciphered" and represented by one or the other of the two components; in the 
case of the letters in odd positions, the a.mount is 40 percent, in the case of letters in even posi~ 
tions, it is 8 percent. 
m. Finally, what of the peculiar phenomenon to be observed in the case of the first column 
of the fifth period of the example in subparagraph e? Here is a case wherein the plain-text 
value of a pair of superimposed components is unmistakably indicated directly by the cipher 
components themselves. Studying the cipher group concerned it is noted that it contains 
2 Aa's separated by one letter, that is, the A's are 2 intervals apart. This situation is as though 
the plain-text letter were entirely self-enciphered in this case. Now it is obvious that this 
phenomenon will occur in the case of periods of 5 letters every time that within a period a cipher 
letter is repeated at an interval of 2, for this will bring about the superimposition of a 01 and 02 
with the same principal letter and therefore the plain-text letter is indicated directly. This 
question may be pertinent: How many times may this be expected to happen? Analysis along 
the lines already indicated will soon bring the answer that the phenomenon in question may be 
expected to happen 4 times out of 100 in the case of letters in odd positions and only 8 times out 
of 1,000 in the case of letters in even positions. In the latter cases the letters involved are those 
falling in the diagonal sloping from left to right in the substitution matrix. 
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n. All of the foregoing phenomena will be useful when the solution of an example is under- 
taken. But before coming to such an example it is necessary to explain how to ascertain the 
period of a cryptogram to be solved. 
51. Ascertaining the length of th~ period.-a. There are several methods available for 
ascertaining the length of the period. The simplest, of course, is to look for repetitions of the 
ordinary sort. If the period is a short one, say 3, 5, 7 letters, and if the message is fairly long, the 
chances arc good that. a polygraph which occurs several times within the message will fall in 
homologous positions within two different periods and therPfore will be identically enciphered 
both times. There will not be many such repetitions, it is true, but factoring the intervals 
between such as do occur will at least give some clue, if it will not actually disclose the length of 
the period. For example, suppose that a 7-lettcr repetition is found, the two occurrences being 
separated by an interval of 119. The factors of 119 are 7 and 17; the latter is unlikely to be the 
length of the period, the former, quite likely. 
b. If a polygraph is repeated but its two occurrences do not fall in homologous positions in 
two periods, there will still be manifestations of the presence of repetition but the repeated letters 
will be separated by one or more intervals in the periods involved. The number of repeated 
letters will be a function of the length of the polygraph and the length of the period; the interval 
between the letters constituting the repetition will be a function of the length of the period and 
the position of the repeated polygraph in two periods in which the two polygraphs occur. 
Note 
what happens in the following example: 


SENDTHR 
'4313232 
6 
3 
3 
2 
2 
4 
3 


PNRGETP 
-"--../- 


EEMENDO 
3 
3 
1 
3 
1 
3 
4 


3 
8 
1 
3 
3 
2 
2 
E N N P B E T 
-"--../- 


WNTOEND 
6 
1 
2 
4 
3 
1 
3 
2 
3 
2 
2 
3 
3 
2 


V I B D D R D 
'-----./- 


CRYPTOGRAM 


0 F E N D I C 
4 
1 
3 
1 
3 
2 
2 
2 
6 
3 
8 
2 
4 
1 
LBDTXDL 
-'--.._/- 


0 T T R 0 A D 
4 
2 
2 
2 
4 
1 
3 
2 
2 
2 
3 
2 
2 
2 


0 T L D T D T 


PNRGE TPENN PBETV IBDDR DLBDT XDLOT LDTDT 


Here the plain text contains the trigraph END 4 times. The ENDP in the first period gives rise to 
1234667 


the cipher letters . N . • E . . ; in the second period this trigraph also produces 
1234667 
• 
• 
• 
. . N . . E . 
The interval between the N0 and the E0 is 3 m both cases. 
Two tunes this 


interval plus one gives the length of the period. In this case the initial letter of the repeated 
trigraph falls in an even position in the period in both occurrences. The ENDP in the third period 
1 
2 
3 
4 
6 
6 
7 
gives rise to the cipher lette,rs . . B . . . D; in the fourth period it also produces 


1 
2 a , 
6 
6 
1 
• 
l 
T 
· 
h. 
. B . . . D . 
The interval between the B0 and the D0 is 4 m bot 1 cases. 
wo tunes t is 


interval minus one gives the length of the period. In this case the initial letter of the repeated 
trigraph falls in an odd position in the period in both occurrences. 
c. The foregoing properties of repetitions in this system afford a means of ascertaining the 
length of the period in an unknown example. First, it is evident that a repeated trigraph in the 
plain text produces two different pairs of cipher equivalents according to whether the initial 
letter of the trigro.ph occurs in an odd or an even position in the period. The two letters con- 
stituting the repetition in the cryptogram will not be sequent but will be separated by an interval 
of 1, 2, 3, ... letters depending upon the length of the period. This interval, however, is half 
of the period plus or minus one.4 
Conversely, if in a cryptogram there are repetitions of pairs of 


'The student must remember that the text is here concerned only with cases in which the period is ~dd. 


Jn the case of even periods the interval separating the 2 letters is always exactly half of the length of the penod. 
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letters separated by an interval x, it is probable that these repetitions represent repetitions of 
plain-text trigraphs which occupy homologous positions in the period. The interval x (between 
the letters constituting the repetition in the cipher text) then gives a good clue to the length of 
the period: p{length of period) =2x±l. 
d. A special kind of index is prepared to facilitate the search for repetitions of the nature 
indicated. If tabulating machinery is available, an alphabetically arranged index showing say 
10 succeeding letters after each A0 , B0 , C0 , ••• Z0 is prepared for the cryptogram. Then this 
index is studied to see how many coincidences occur at various intervals under each letter. For 
example, under A0 one looks to see if there are 2 or more cases in which the same letter appears 
2, 3, 4, ... intervals to the right of A, a record being kept of the number of such cases under 
each interval. The same thing is done with reference to B0 , C0 , and so on. The tallies repres('Ilt- 
ing coincidences may be amalgamated for all the letters A, B, C, ... Z, only the intervals being 
kept segregated. When tabulating machinery is not available, the search for repetitions may be 
made by transcribing the cryptogram. on two long strips of cross-section paper, juxtaposing the 
strips at A, B, C, ... Z, and noting the coincidences occurring 1, 2, 3, ... up to say 10 letters 
beyond the juxtaposed letters. For example, beginning with A0 , the two strips are juxtaposed 
with the first A on one against the first A on the other. Note is made of any coincidences found 
within 10 letters beyond the A's, and a record is kept of such coincidences according to intervals. 
Keeping one strip in position the other is slid along to the second A, and again coincidences are 
sought. All the A's are treated in this way, then the B's, C's ... Z's. 
The record made of the 
coincidences may consist merely of a tally stroke written under the intervals 1, 2, 3, ... 10. 
That interval which occurs more frequently than all the others is probably the correct one. This, 
interval times 21 plus or minus 1 is the length of the period. 
There are, therefore, only two alter- 
natives. A choice between the two alternatives may then be made by transcribing the text or 
a portion of it according to each hypothesis. That transcription which will most often throw 
the two members constituting a repetition into one and the same period is most likely to be 
correct. 
e. Finally, for ascertaining the period there is one method which is perhaps the most labori- 
ous but surest. It has been pointed out that this system reduces t.o one that. may be described 
as monoalphabetic substitution with variants. If the cipher text is transcribed into 8 1 and 8 2 
components according to various assumed periods, and then a frequency distribution is made of 
the pairs of vertical components for each hypothesis, that period which gives the best approxi- 
mation to the sort of distribution to be expected for a system of monoalphabetic substitution 
with 25 variants for each letter may be taken to be correct. For in the case of an incorrect period 
the resultant vertical bipartite components are not the equivalents of the actual plain-text 
letters; hence such repetitions as occur are purely accidental and the number of such cases would 
be rather small. But in the case of the correct period the resultant vertical pairs of components 
are the equivalents of the actual plain-text letters; hence repetitions are causal and fairly fre- 
quent. Were it not for variants, of course, the distribution would be perfectly monoalphabetic. 
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52. Illustration of solution.-a. With the foregoing principles in mind, the following cryp- 
togram will be studied: 


K Z F BE IL Y Y M 0 C B R B L Z D 0 T GB LP K y w c u c C E P Q L 
AMEYL Z Q X W H LR W Q Y DR W BM T I Z E B E L A Y E S 0 B R Y 
Q VB BL Y X NAB Q B D 0 Y M Q D L W L N A C 0 X CR R G A S W Q B 
FD DTE BAM FD ET EN A K G D F 0 Q DUB N DC LY D V W BAX 
C A U G G X 0 ART XX TS D A Y X HK 0 L S X A BR KR P U Z W H 0 
MT DH T S G M L S L Q P 0 U NH C I C K KA QB D 0 F L E KAP R G 
s x u p 0 WAL MA V Q H L M LAX KP W S T M C X K Q V H SIX SL 
L W XL X RS G Z D F KL NY BX MR B NA DK T T B A E 0 BHWVL 
Y S X MB 0 WP G X K 0 R Z I 
U C E A D Y I D B L Z M I T A N H C A I 
D N C I D D 0 Y I B C N 0 L Y U U M C E P 0 TD M GB FUN AHL B D 
WXNXK K C S C T 0 X T S D AYXHK C NL DK RR FAY AP M H C 
ANMBV GR E Z Q A T C Y I 
MN DLR LG MT W E T R C V V KT ED 


U FD EL X HE Q V CB LY U DUG YA F H N Q L K FR UC NVDLJj 
L Z DRE L K X KU P S E M C TN KT K EBO EE P G V Q T GWERJj 
L Z DRE L K FAX I Y D A K Z L XX 0 RR PER RR RN C I E 


b. The long repetitions noted in the text (interva.ls=210 and 35) indicate o. period of either 
5 or 7. By transcribing several lines of text into their 01 and 02 components according to both 
of these alternatives and distributing the vertically superimposed pairs, it is soon found that a 
period of 7 produces many more repetitions than does a period of 5. 
The entire text is then 
transcribed into its 0 1 and 0 2 components according to a period of 7 (see fig. 89) and complete 
distributions of 0 10 2 and 0 20i vertical pairs are made, the dist1ibutions being, of course, kept 
separate. They are shown in figures 90 and 91. 
The individual distributions show many 
repetitions and the distributions as a whole are very favorable for a period of 7. 


1 
2 
3 
4 
5 
K Z F B E I L YYMOCBR B L Z D 0 T G B L P K Y W C U C C E P Q L 


K1 Kz Z1 Z2 Fi F2 Bi Yi Y2 Yi Y2 Mi M1 Oi Bi B2 Li L1 Zi Z2 Di Bi B2 Li Lt Pi P2 Ki 
Ui U2 Ci C2 Ci Cs Ei 
B2 E1 Es Ii I2 L1 Lz 02 C1 C2 B1 B2 R1 Rs 
Dz 01 02 T1 T2 G1 G1 
Kz Y1 Y2 W1 W2 Ci C2 
E1 P1 P2 Qi Qz L1 L1 


6 
7 
8 
9 
10 


AMEYLZQ XWHLRWQ YDRWBMT I Z E B E L A YESOBRY 


Ai A1 Mi M2 E1 E2 Yi Xi Xs Wi W2 Hi H2 Li Yi Y2 D1 D2 Ri Rz Wi Ii I2 Zi Zs Ei Es Bi Yi Y2 E1 E1 S1 S2 Oi 
Y2 L1 L1 Z1 Z2 Qi Q2 Lt R1 Rz Wi W2 Qi Q, 
W2 B1 B2 M1 M1 Ti T1 B2 Ei Ez Li Lt Ai A2 
02 B1 B2 R1 Rz Y1 Y2 
11 
12 
13 
14 
15 


QVBBLYX N A B Q B D 0 YMQDLWL N A C 0 X C R RGASWQB 


Qi Qz Vi V2 B1 B2 B1 Ni N2 Ai Az Bi B2 Qi Yi Y2 M1 Mz Q1 Q1 Di Ni N2 Ai As C1 C2 01 Ri Rs Gi Gs Ai A1 Si 
B2 L1 L2 Y1 Y2 X1 X2 Qz B1 Bs Di D2 Oi 02 Dz Li Lt W1 W2 Li Lz 02 Xi Xz Ci Cs Ri Rs S2 Wi W2 Q1 Qz B1 B2 


16 
17 
18 
19 
20 


FDDTEBA MFDETEN AKGDFOQ DUBNDCL YDVWBAX 
Fi F1 Di Dz D1 Dz Ti M1 Ms F1 F1 Di Dz Ei 
A1 A2 Ki K1 Gi Gs D1 
D1 D2 Ui U2 Bi B2 Ni Yi Y2 Di D2 Vi V2 Wi 
T1 E1 Ez Bi B2 Ai A2 Es Ti Ts Ei Es Ni Ns 
Dz Fi Fz Oi 02 Qi Qz 
N1 Di Dz Ci C2 Li Ls 
W2 Bi B2 Ai A1 Xi X2 
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21 
22 
23 
24 
25 
C A U G G X 0 
A R T X X T S DAYXHKO LSXABRK RPUZWHO 
Ci C2 Ai A2 Ui U2 Gi l\i A1 Ri Rt Ti T2 Xi 
D1 D2 A, A1 Yi Y2 Xi L, L2 Si S2 Xi X2 Ai Ri R2 Pi P2 U1 U2 Zi 


G2 Gi G2 Xi X2 Oi 02 X2 Xi X2 T, T2 Si S2 
X2 Hi H2 Kl K2 01 02 
A2 Bi B2 Ri R2 Ki Kz 
Z2 Wi W2 Hi H2 Oi 02 


26 
27 
28 
~9 
30 
MTDHTSG M L S L Q P 0 
U N H C I C K K A Q B D 0 F LEKAPRG 


M, M2 T1 T2 Di D2 H, Mi M2 Li L2 S1 S2 Li Ui U2 Nt N2 Hl H2 C1 
Kt K2 At A2 Qt Q2 Bi Li L2 Ei E2 K1 K2 Ai 


H2 Tl T2 S1 S2 G1 G2 L2 Q, Q2 P1 P2 01 O, 
C2 Ii I2 Ci C2 K1 Kt 
B2 D1 D2 Oi 02 Fi F2 
A2 P, P2 Ri R2 G, G2 
31 
32 
33 
34 
35 
S X U P 0 W A LMAVQHL MLAXKPW S T M C X K Q V H S I X S L 
S, S2 X, X2 U, U2 P1 L1 Lt Mi M2 Ai A2 Vt 
Mi M2 Li Lt A1 A2 Xi Si S2 Ti T2 M1 M2 C1 
V1 V2 Hi H2 S1 S2 Ii 
P2 O, 02 Wi W2 Ai A1 V2 Qi Q2 Hi H2 L1 L2 
X2 K, K2 Pi P2 W1 W2 
C2 X, X2 K, K2 Q, Qt I2 Xi X2 Si S2 Li L2 
36 
37 
38 
39 
40 
LWXLXRS GZDFKLN YBXMRBN ADKTTBA EOBHWVL 
Li Lt Wi W2 X1 X2 L1 Gi Gt Zi Z2 D1 D2 Fi Yi Y2 Bi B2 Xi X2 M1 
A, A2 D1 D2 Ki K1 T 1 E1 E2 01 02 B1 B2 Hi 


Lt X, X2 Ri R2 Si S2 F2 Ki K2 Li L2 Ni Nz 
M1 R1 R2 B1 B2 Ni N1 
T2 T, T1 B1 B2 A, A2 
H2 W, W2 V1 V2 Li L2 
41 
42 
43 
44 
45 


YSXMBOW PGXKORZ I U C E A D Y I D B L Z M I 
T A N H C A I 


Yi Y 2 S1 S2 Xi X2 M1 Pi P2 Gi G2 Xi X2 K1 I, I2 U1 U2 C1 C2 E1 
I1 I2 D1 Dz B1 B2 L, 
T1 T2 A1 A2 N, N2 H, 
M, Bi B2 Oi 02 W1 W2 
K2 01 02 R, R2 Z1 Z2 
E2 Ai A2 Di Dz Y1 Y2 Lt z, Z2 Mi M2 I I I2 H2 C, C2 A, A2 I1 I2 
46 
47 
48 
49 
50 


D N C I D D 0 
Y I B C N 0 L 
Y U U M C E P 
0 T D M G B F UNAHLBD 
"' 
.if 


D1 Dz N1 N2 Ci C2 I1 Y, Y2 I1 I2 B1 B2 C1 Yi Y2 Ui U2 Ui U2 M1 
Oi 02 T1 T2 D1 D2 Mi 
U1 U2 N1 N2 A1 A2 H1 
· .. 


I2 Di D2 D1 D2 01 02 C2 Ni Nt O, 02 Li L2 
M2 C1 C2 Ei E2 P, P2 
M2 G, G2 B1 B2 F1 F2 
H2 L1 Lt B1 B2 D1 Dz 


51 
52 
53 
54 
55 


: ~ 
WXNXKKC S C T 0 X T S DAYXHKC NLDKRRF K Y A P M H C 


Wi W2 Xi X2 Ni N2 X1 S1 S2 Ci C2 T1 T2 01 
Di D2 A1 A2 Y1 Y2 X1 
N1 N1 Li Lt Di Dz Ki Ki K2 Yi Y2 Ai A2 P, 


X2 Ki K2 Ki K2 Ci C2 02 Xi X2 T1 T2 Si S2 X2 Hi H2 K1 K2 Ci C2 Kt Ri R2 Ri R1 Fi F2 P2 Mi M2 Hi H2 C, C2 
56 
57 
58 
59 
60 
ANMBVGR E Z Q A T C Y IMNDLRL GMTWETR C V V K T E D 


A1 A2 Ni N2 Mi M1 Bi Ei Ez Zi Zt Qi Qz Ai Ii I2 Mi Mz Ni N1 Di 
G1 Gt M1 M1 T1 T1 W, 
Ci C2 Vi V2 Vi V2 K1 
B2 V 1 V 2 Gi Gt Ri R2 A1 Ti T2 Ci C2 Yi Y2 
D2 Li L2 R1 R2 Li L2 
W2 Ei E2 Ti T2 Ri R2 
K2 Ti T2 Ei E2 Di Dz 


61 
62 
63 
64 
65 


UFDELXH E Q V C B L Y UDUGYAF HNQLKFR UCNVDLH 
Ui U2 Fi F2 Di D2 Ei Ei E1 Qi Qz Vi V2 C1 
Ui U2 Di D2 Ui U2 Gi Hi H2 Ni Nt Q1 Qz L1 
Ui U2 Ci C2 N1 N2 V1 


E2 Li L1 Xi X2 H1 H2 C2 Bi B2 L1 I.., Y1 Y2 Gt Yi Y2 Ar A2 Fi F, Lt Ki K1 Fi F2 Ri R1 
V2 Di Dz L1 Lt H1 H2 
66 
67 
68 
69 
70 
LZDRELK XKUPSEM C T N K T K E B 0 E E P G V QTGWERH 
Li L2 Z1 Zt Di Dz R1 Xi X2 Ki K2 Ui U2 Pi Ci C2 Ti T2 Ni N2 K1 
B1 B2 01 02 E1 E1 Ei Qi Qz T1 T2 G1 G2 Wi 
R1 E1 E1 L1 L1 K1 K1 P2 S, S2 E1 E1 M1 t/2 
K2 T1 T2 K1 K2 E1 E1 E2 Pi P2 Gi G2 V1 V2 
W2 E1 E2 R, R2 H1 H2 
71 
72 
73 
74 
75 


LZDRELK F A X I Y D A KZLXXOR RPERRRR N C I E 
Li Lt Zi Zt D1 Dz Rt F1 F2 Ai Az X1 X2 I, K1 K2 Zi Zt L1 Lt Xi Ri R2 Pi P2 E1 E2 Ri Ni N2 C, C2 
Rs Ei E1 Li Lt Ki Ks I1 Yi Y2 Di 0t Ai A2 Xz Xi Xz Oi 02 Ri R1 
R2 Ri R1 Ri R1 R1 R1 Ii I2 Ei E1 
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c. The text now being transcribed into periods of 7, with the 0, and 02 components indicated 
by the cipher lett~·rs in each period, the vertical pa~ of components are ex~mine~ to locate 
cases in which the basic letters of the 9i and 92 stJ.perrmposed components are 1dentwal, where- 
upon the plain-text letters indicated are at once inserted into position. In this example 10 
such cases are found, one each in periods 14, 22, 26, 35, 36, 52, 59, 68, and two in period 74. 
All of these, of course, involve letters in odd positions in the periods. The plain-text letters 
thus inserted may serve as clues for assuming probable words. 
d. Now if only a few equivalencies can be established between a few of the 91 components, 
or between a few of the 9 2 components, or between a few 01 and 92 components, a long step for- 
ward may be taken in the solution. Perhaps some information can be found by studying 
figures 90 and 91. A consideration of fi_gure 90 will soon ll'ad t? the ~rle_a tha~ each r~w _of ~re­ 
quencics can indicate only 5 different plam-text letters, one of winch comc1des with the md1catmg 
letter at the left of the row. 
Moreover, in this same figure, while there are 25 rows in all, there 
are really only 5 different categorie8 of rows, each category corresponding to a row in the 
substitution checkerboard. 
e. To explain quite clearly what is meant and how the principle can be employed in this case, 
assume that figure 90, instead of applying to an unknown checkerboard, applied to a. known 
one, say that shown in figure 87. The bipartite coordinates and the letters which would occupy 
the cells are as seen in figure 92: 


1 A 
3 B 
2 c 
3 D 
3 E 
1 F 
2 G 
3 H 
2 I 
3 K 
4 L 
1 M 
1 N 
4 0 
4 p 
4 Q 
2 R 
4 s 
2 T 
1 u 
5 v 
5 w 
5 x 
5 y 
5 z 


2112355445113234352412345 
A B C D E F G H I K L M N 0 P Q R S T U V W X Y Z 


A M M A N F F u u F M M N A N u N F A u M A N u F 
,__ 
1f H K B B E D E 1f E K D H B D E H K 
D B B D E K K 
,_ 
- c 
G G I I G c c R T R T R G T I c T R I G 
T 
c T R 
D B B D E K K H H K B B E D E 1f E K D H B D E H K 
'-- 
D B B D E K K H H K B B E D E H E K D H B D E H K 
'A M M A N F F u u F M M N A N u N F A u M A N u 'r 
'T c c T R G Cf I I G c c R T R I R G T I c T R I G 
,_ 
....._ 


H H K B B E D E 1f E K D H B D E H K 
D B B D E K K 
'T c c T R G G I I G c c R T R I R G T I c T R I '(; 


D B B D E K K H H If B B E D E 1f E K D H B D E H K 


L-- 
p s 
Q Q s L L 
0 L L 0 
s 
p 0 p Q p s 0 Q L 0 p Q s 


7: M M A N F F u u F M M N A N u N F T u M T N u 'r 
A M M A N F F u u F M M N T N u N F A u M A N u F 
- 
- 
p s s Q Q s L L p 0 p Q p s 0 Q L 0 p Q s 
0 L L 0 
0 L L 0 p s s Q Q s L L p 0 p Q p s 0 Q L 0 p Q s 
0 L L 0 p s s Q Q s L L p 0 p Q p s 0 Q L 0 p Q s 
'T c c T R G G I 
I G c c R T R I R Cf T I c T R I G 


0 L L 0 p s s Q Q s L L p 0 p Q p s 0 Q L 0 p Q 's 
'-- c 
G Cf I I G c c R T R T R G T I c T R I G 
T c 
T R 


'A M M A N F F u u F M M N A N u N F A u M A N u 'F' 
w v v w x z z y y z v v x w x y x z w y v w x y z 
w v v w x z z y y z v v x w x y x z w y v w x y z 
,_w v v w x z z y y z v v x w x y x z w y v w x y 'z 
w v v w x z z y y z v v x w x y x z w y v w x y z 
'-- v 
z z y y z v v 
w v 
w x 
x w x y x zrw y v w x y z 


F1GUBE 9ll. 


,, 
·t' 
' 
1 I 
; 
i 


f i 
I 
, 


.. i . 


. :··:I 
. ! 


! · t 
: i I 
' 'i 


ii 
I' 


1· .j i 


r: 
11 : I 
I 
i 


ji1 
1;; 
·::) 


J! 
! 


:1 


1 · l 
, I 


i 
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Now consider the A row and the F row. The 25 letters in both rows of cells aTe, from the very 
nature of the system, identical in their sequence and there sre only 5 different letters involved, 
each appearing 5 times. Therefore it would seem that frequency distributions corresponding to 
these rows should show definite charscteristics by means of which they could be compared 
statistically. Furthermore, the 0 1 coordinates applying to these two rows, A1 and F1, indicate 
that A and Fare in the same row in the checkerboard. What hss been said of the A and F rows 
also applies to the M, N, and U rows, for the letters A, F, M, N, and U are all in the same row in the 
checkerboard (fig. 87). Perhaps a statistical test can be applied to ascertain which rows of 
distributions in figure 90 are similar and this in turn may give clues to the letters which fall in 
the same row in the checkerboard applicable to the problem in hand. 
j. Again, consider the columns in figure 90. What has been said of the rows applies equally 
to the columns, and therefore the same sort of test may also be applied to the columns of figure 
90 for clues as to the composition of the columns of the checkerboard applicable to the problem 
under consideration. If there WPre sufficient text much of the labor of solving such cases would 
be reduced to a matter of statistical anulysis. But what sort of statistical test should be used? 
Obviously it should be one based upon "matching" the distributions of figure 90, but specifically 
what should it be? Note the distributions in rows D and M; they appear to be similar. Is it 
correct to apply the usual x-test for matching two frequency distributions? Consider the com- 
position of the rows of figure 90, and specifically consider the A and F rows, composed as follows: 


A__________________ A M M A N F F U U F M M N A N U N F A U M A N U F 
F------·----------- A M M A N F F U U F M M N A N U N F A U M A N U F 


Here the letters in opposite cells are identical and there are only 5 different letters involved: 
A, M, N, F, and U. 
Of these only 3 arc high-frequency letters in norms! plain text; 2 are of medium 
to low frequency. But the high-frequency letters in the A row match those in the F row, the 
low-frequency letters in the A row also match the low-frequency letters in the F row. Hence, 
if frequency distributions corresponding to these rows are tested statistically, they should yield 
a fairly high index of coincidence. But should the constant .0667 (probability of monographic 
coincidence in normal English text) be used in the test? Obviously not, for this constant is derived 
from statistics based upon the normal frequencies of all 26 letters of the alphabet, whereas here 
only 5 letters are involved and the exact 5 involved in any example is determined by the compo- 
sition of the checkerboard. Again, consider the A and Crows of figure 90, composed as follows: 


A................ A M M A N F F U U F M M N A N U N F A U M A N U F 
C________________ T C C T R G G I I G C C R T R I R G T I C T R I G 


Here is a case where, by chance, high-frequency letters stand opposite high-frequency letters 
(A and T, N and R); medium-frequency letters stand opposite medium-frequency letters (Mand 
C, F and G). 
The only csse of fairly marked difference is in that of the pairing of U and I. 
Hence, a statistical matching of frequency distributions applying to these two row11 would be 
apt to yield a high index of coincidence. Yet, these two rows do not belong together and to 
assume ths t the letters A and C belong in the same row in the checkerboard would block or at 
least retard solution. In spite of the foregoing reasoning, there nevertheless remains the feeling 
that a statistical matching of the rows should be possible or should st least offer some clues as 
to the composition of the checkerboard. 
g. In applying the usual x-test for matching two distributions use is made of the impoTtant 


constant .0667, the probability of monographic coincidence for normal English text. This 
constant may be modified to meet the special conditions of the present problem. If it be assumed 
that the mixing of the letters in the checkerboard is fairly good, in normal cases it may be assumed 


-~ ' 
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that there will be 1 high-frequency letter, 3 medium-frequency letters, and 1 low-frequency 
letter in each row and in each column of the checkerboard. Suppose the le~ters in each category 
be as follows: 
· 


High frequency __________________________________ A E I N 0 R S T· 
Medium frequency ______________________________ B C D F G H L M P U Y 
Low frequency ____________________________________ K Q V W X Z 


Adding the squares of the probabilities for separate occurrence 5 of the letters in each category: 


A 
.0054 
B 
.0001 
K 
.0000 


E 
.0169 
C 
.0009 
Q .0000 


I 
.0054 
D 
.0018 
V 
.0002 
N .0063 
F 
.0008 
W .0002 
0 
.0057 
G 
.0003 
X .0000 


R 
.0057 
H .0012 
Z 
.0000 
S 
.0037 
L 
.0013 


T 
.0084 
M .0006 


Total=. 0575 


Average=. 0072 


p 
.0007 
u .0007 
y 
• 0004 


Total= . 0088 


Average=. 0008 


Total= . 0004 


Average=. 00007 


Since each row of figure 90 contains 25 letters, composed of 5 different letters each appearing 5 
times, and it is assumed that each row of the checkerboard contains 2 high-frequency letters, 2 
medium-frequency letters, and 1 low-frequency letter, the rows in figure 90 will be composed of 
10 high-frequencs letters, 10 medium-frequency letters, and 5 low-frequency letters. Therefore, 
the sum of the squares of the average probabilities of the letters occurring in each row of figure 
90 is as follows: 
5 x .0072 = .0360 
15X.0008=.0120 
5 x .00007 = .0004 


Total=.0484 


This, then, is the constant that should be applied in the x-test for the problem under consider- 
ation. Suppose, for convenience, the approximation .05 is used. This is considerably less than 
the normal constant .0667 and means that in the case of this problem two distributions can be 
considered to "match" even if the number of coincidences (value of x) is considerably less than 
what would be expected in the case of the normal type of frequency distribution. However, it 
must be remembered that even if two distributions give an observed value for x that is close to 
or even greater than the expected, one can still not be certain that the two distributions apply to 
identical rows of letters and indicate two letters in the same row in the checkeTboard, since it 
may happen that the composition of the checkerboard is such that two rows have letters of about 
the same frequency values, as pointed out above. 
h. With this reservation in mind, let figure 90 be examined. Take rows D and M, which on 
casual examination look a good deal alike, as seen in figure 93. 


•As given in the table on p. 114 of Military Cryptanalysis, Part 1, Appendix 2, par. 2e (1). 
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A B c D E F G H I 
K L M N 0 p Q R s T u v 
1 w x y z 
- 
:::::: - - 
~ 
..... 
- - -- 
::::: -- 
~ 
N=23 


>--- - - - 
- 
- - - - - - - 
- 
- - - - - - - - 
- 
- --,_ 
- 
::::: - - 
..... - ~ 
..... 
...... - 
- - 
N=16 


J'IGUH 113. 


Applying the x-test, the observed value of x=34, the expected value is .05 (23X16)=18. An 
excellent match is obtained, and the hypothesis that D and Mare in the same row in the checker- 
board seems promising. Can any confirmation be found in the cryptogram itself? 
i. It has already been pointed out that this system reduces to monoalphabetic substitution 
with variants. This being the case it should be possible to find manifestations of equiva.lency 


between some of the variant forms of :: vertical pairs in the cryptogram. If the student will think 


over the matter he will quickly see that this manifestation of equivalency is but a reflection of 
the principle elucidated in paragraph 46, expressed in a little different way. In other words, 
establishing equivalence between two 01 components means that the two base letters involved 
belong in the same row of the checkPrboard; establishing equivalence betweeen two 0 2 compo- 
nents means that the two base fott.crs involved belong in the same column of the checkerboard. 
Note the following instances of apparent Pquivalency between Di and Mi: 


Period 16 
D2 B1 
D1 B2 
Period 18 
~QI 
D1 Q2 
20 
Y2 B1 
D1 82 
32 
L1 Qi 
M1 Qs 


49 
T2 81 
D1 B2 
16 
F2 E1 
D1 E2 
2 
Y2 81 
M1 B2 
17 
F2 E1 
D1 E2 
3 
Z2 G1 
D1 G2 
59 
G2 E1 
M1 E1 


56 
N1 G1 
M1 G2 
12 
A1 B2 
A1 Di 
B1 D2 
13 
Q2 L1 
D1 L2 
50 
Ai Bs 
Az D1 
Hi D2 
37 
Z2 Li 
Di L2 
8 
D1 82 
D2M1 
R1 Ms 


58 
Nz Li 
D1 Lz 
19 
Di N1 
Dz D1 
Ui Dz 


66 
Z2 L1 
Di Lt 
46 
Di Iz 
Dz Di 
N1 Dz 


71 
Zz Li 
D1 L2 
44 
Di Zz 
Dz Mi 
B1 Ms 


6 
A1L1 
M1 L2 
43 
U1 Az 
U2 Di 
C1 Dz 


13 
Y2 L1 
M1 La 
67 
U1 E1 
U2M1 
PiM2 


58 
I2 Li 
Mi La 


It may be assumed D1=Mi and the two distributions in figure 93 may be amalgamated. 


~+~ 
ABCDEFGHIKLMNOPQRSTUVWXYZ 


~ 
~-~-~~~ 
~ 
-~-~ 
-~-~ 
:::: 
::::: 


The only other row in figure 90 which gives indications of being similar to this distribution is the 
A row. Applying the x-test individually to the 01 and M1 distributions, and ··then to the combined 
D1 +Mi distribution: 


Di 
A : C D ~ F ~ H ! K ~ M ~ 0 P ~ ~ ~ ! U V W ~ ! ~ 
N=23 


::: - 
:::::: 
N=24 
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Expected for plain text: 
.05 (23X21}=24 
Expected for random text: .038 (23X21)=18 
Observed 
=26 


A B C D E F G H I K L M N 0 P Q R S T U V W X Y Z 
- 
~--~ 
-~ - -- 
-- 
. 
::::::: 


Expected for plain text: 
.05 (16X21)=17 
Expected for random text: .038 (16X21)=13 
Observed 
=14 


ABCDEFGHIKLMNOPQRSTUVWXYZ 
~ 
§~~--~~ 
~ 
-~-~- 
-~-~ 
;:: 


Expected for plain text: 
.05 (39X21)=41 
Expected for random text: .038 {39X21)=31 
Observed 
=39 


N=16 


N=21 


N=39 


N=21 


From the foregoing calculations it appears that Ai may be similar~ the D1 and. the Mi distribu- 
tions for the observed values, while not as great as expected for plam text, are higher than those 


e,xpe~ted for random text. Perhaps more conclusive evidence may be found if a search were 
made through the text to see if any equivalences between Ai, Di, and Mi, appear. 
Note the following cases: 
Period 
8 
Y2 Bi 


12 
N2 B1 


50 
N1 Bi 


16 
D2 Bi 
20 
Y2 B1 
49 
T1 Bi 


2 
Y2 B1 


A1 B2 
Ai B2 
A1 B2 
Di B2 
Di B2 
D1 B2 
M1 B2 


A1 Mi 
As Di 
A1 D1 
D2 Ai 
D2 Ai 
D2 Fi 
M1Ri 


21 
C2 Gi 
Ai ~ A2 Xi 
30 
K1 Gi 
A1 G2 
S, P2 


3 
Z2 Gi 
Di G1 
8i Kz 


56 
N1 G1 
Mi Gt 
M2 R1 


24 
:XS Ki 
Ai K1 
Ri Z2 


34 
T2 Ki 
Mi K1 
Mz Qi 


Period 33 
48 


15 
18 
32 


14 
61 


57 
72 
63 


It certainly seems as though A1=01=Mi, and that these letters are in the same row in the checker- 
board. This tentatively will be assumed to be correct. 


3241511--41~12 


I 
; 


i 


1i 
II 


,. 
I I 


I' 


I.' 


I I 


~ 


' ~ 
I 
1 
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j. Among the most frequent combinations is the pair Y2 811 appearing in the following 
sequences: 


Period 2 
8 
10 
20 
41 


Y2 Ci 


Li~ 
8i A1 
Ni La 
Hi La 


Yi C2 
Yi Ws 
Yi 02 
Yi Wa 
Yi Ma 


Y2 8i 
Y2 8i 
Y2 8i 
Y2 8i 
Ya 8i 


Mi 82 
Ai 82 
Ei 82 
Di 82 
Si 8a 


M2 Ri 
Aa Mi 
E2 Ri 
D2 Ai 
Sa 01 


Note how M11 A11 E11 011 and Si all appear to hP interchangeable. Are these the 5 letters which 
belong in the same row? The probable equivalence among A11 011 and Mi has been established by 
noting cases of equivalency in the text. A further search will be made to see if E1 and S1 also 
show equivalencies with A11 011 and Mi. 


Note the following: 


Period 21 
C2 Gi 
Ai G2 
Period 12 
Na 8i 
A1 82 
A2 D1 


30 
Ka Gi 
Ai Ga 
10 
Ys 81 
E1 8s 
Es R, 


3 
~Gi 
Di G2 
30 
Ls P1 
Ei Pa 
E2Ri 
69 
02 Gi 
Ei Ga 
33 
L2 P1 
Ai Ps 
A2 Wi 
56 
Ns G, 
M1 Ga 


23 
Di:X. 
~Hi 
Ai H2 
43 
C2 Yi 
Ei Y2 
Ii La 


32 
Mi~ 
Mz Hi 
Ai Ha 
57 
~Yi 
Ai Y2 
Ii~ 


61 
Di Xa 
~Hi 
Ei H2 


Here are indications that Ei belongs to the same series, but not enough cases where Si is inter- 
changeable with A, D, E, or M can be found to be convincing. But perhaps it is best not to go 
too fa.st in these early stages. Let it be assumed for the present that A, D, E, and M are in the 
same row of the substitution checkerboard. In period 16 there is the pair of vertical com- 
ponents Di E2• 
Since Di=E1 this pair may be written E1E2, whereupon the plain-text letter Eis 
immediately indicated. .All cases of this sort are sought in the text and the plain-text letters 
are inserted in their proper places, there being 7 such instances in all, but these yield the im- 
portant letters, A, D, and E. 
k. In a similar manner, by an intensive search for cases in which components appear to be 
equivalent because they occur in repetitions which are identical save for one or two components, 
it is established that C, 0, M, and Ware in the same column in the checkerboard. Note the bracket- 
ing of these letters occurring as 02 components in the 4th column of the first list of sequences 
in subparagraph j. Likewise, 8, H, and N are established as being in the same row. 
Again 
the text is examined for cases in which plain-text letters C, 0, M, W, 8, H, and N may be inserted. 
By carrying out this process to the full extent possible, the skeletons of words will soon begin 
to appear. 
l. Enough has been demonstrated to show this line of attack. Of course, if there is a large 
volume of text at hand, the simplest procedure would be to construct frequency distributions 
of the types shown in figures 90 and 91, and use the statistical method to match the individual 
distributions. For this method to be reliable it would be necessary to have several hundred 
letters of text, but this in actual practice would not be too much to expect. 
m. There is, however, another line of attack, based upon the probable-word method. It 
has been pointed out that, in the case of letters in odd positions in the periods, 40 percent of the 
time the plain-text letter involved is indicated by either its 01 or 02 component. This property 
affords a fair basis for assuming a probable word. For example, the cryptogram here studied 
shows the following two periods: 


€. 
'.: 


, . 
.. 
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Period______________ 
3 5 
36 
Plain text_________ 
S 
L 


{vi v 2 Hi H 2 s 1 s 1 I 1 
Components______ I 2 X i X 2 S i S 2 L i L 2 


Cipher text_______ V H 
S 
I 
X S 
L 


Li L1 Wi W2 Xi X2 Li 
L1 Xi Xs Ri R1 Si S1 
L W X L X R S 


Two letters are quite definite, s. and L.. Suppose the possible plain-text letters be indicated. 


Period______________ 
35 
36 
Possible plain-{V 
H 
S 
I 
L 
W 
X 
L 
text letters____ I 
X 
L 
X 
R 
S 


{ 
V 1 V 2 H i H 2 S i S 2 I i 
L 1 L 2 W i W 2 X i X 2 L i 


Components______ I 2 X i X 2 S 1 S 2 L i L 2 
L 2 X i X 2 R 1 R 2 S 1 S 2 


Cipher text_______ V H S 
I 
X S 
L 
L 
W X L 
X R 
S 


The word HOSTILE is suggested by the letters H . S . I L . . This word will be assumed to be 
coITect and it will be written out with its components under the cipher components. Thus: 


Period _____________________________________ _ 
35 
36 


Plain text________________________________ 
H 0 S T I 
LE 


. 
{Vi V2 Hi H1 Si S2 Ii 
Cipher-text components____________ I 2 X1 X 
2 S1 S2 L1 L2 


. 
- 
{ 
Hi Oi S1 Ti Ii 
Plain-text components______________ 
Hz 0 
2 s 
2 T2 I 
2 


This word if coITect, yields the following equivalencies: Ht=X2=0i;Si=02; Ti=S2; L1=T2; Ia= 
La=Ei; X1 ' Ea. 
Again the text is examined for cases in which the plain-text letters may now be 
directly inserted; but only one case is found, in period 44, where Ii L2=Ii I2=~P· This is un- 
fortunate, so that additional words will have to be assumed. The 14th period shows a Cp 
and the components after it suggest that the word CROSSROADS may be present. Thus: 


Period________________________________________ 
14 


Plain text__________________________________ 
C R 0 


Components ______________________________ { ~: ~: ~: ~: ~: ~: ~: 


Cipher text________________________________ N A C 0 X C R 


Take the first letter Rp, represented by C2 R1. 


Since Rp = C2 R11 


Therefore, Ri R1=C2 R1 
Hence R1=C2 and R2=R1 
Therefore, R1=R2=C2 


Again, in the case of the first Op, 
0p=01 Rz 


But Op= Oi 02= Oi R1 
02=R2 


Therefore, Ri=R2=02=C2 


15 


S S R 0 A D S 
Ri Rz Gi G1 Ai A1 S1 
S2 Wi W2 Qi Q1 81 82 
RGASWQ8 
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The various equivalencies yielded are as follows: 


C2=R1 =02=S1 =~=G1 =W2=Q1 
S2=W1 =B2=T1 
H1=X2=01 =Gs 
02=Q1 


~=A2=D1 


B1=Dz 
L1=T2 
Lt=I2=E1 
X1=E2 


n. Let all the equivalencies found thus far from subparagraphs e,f, and h be collected in two 
tables, as shown in :figure 94, one for 01 02 combinations, the other for 0 2 01 combinations. 


rl.l 
A1 B1 C1 D1 E1 F1 G1 H1 I1 K1 L1 M1 N1 01 
z D1 H1 
A1 A1 
02 B1 
T1 A1 B1 H2 
0 .... 
E1 N1 
E1 D1 
Cs N1 
D1 H1 It 
E-t < M1 Dz 
M1 M1 
~ Dz 
E1 D1 Gs 
z 
.... I1 
I1 Is 
W2 
12 
IX! 
)l Lt 
Lt Ls 
R1 
Ls 
0 0 
A1 
As A1 
R1 
A2 


~ ~ 
~ ~ 
Si 
Q1 
a> 
Q1 


rl.l 
A2 B2 C2 D1 E1 F1 G1 H1 I1 K1 L1 M2 N1 02 
z A1 T1 M11 Bi X1 
Oi It Ls 
Is C2 
C2 
0 .... 
Di S2 02 H1 
H1 Oi A1 
A1 02 
M:a 
E-t < Ei W1 W2 Ni 
X2 Gs Di 
D1 W2 
W2 
z 
.... 
Mi 
R1 
E1 
E1 R1 
Si 
IX! 
)l I1 
Si 
Mi 
Mi Si 
Ri 
0 0 
L1 
R1 
A2 
A2 R1 
R1 
i 
Q2 
Gi 
Qi 
Q1 G1 
Gi 
Qi 
Qi 
Qi 


FIGUU 94 


A study of the equivalencies indicates that-- 


(1) A, D, E, M belong in the same row. 
(2) B, H, N belong in the same row. 
(3) G, R, S, Q belong in the same row. 
(4) R, C, 0, M, W belong in the same column. 
(5) I, L, A, Q belong in the same column. 
(6) X, H, G belong in the same column. 


P1 Qi R1 S1 T1 U1 V1 W1 X1 Y1 Z1 


G1 G1 02 S2 
T1 Ea 
. Ct C1 C2 W1 
St 
C2 02 M1 St 
Bz 
Ms Ms W2 
W2 W2 R1 
R1 Rs R1 
R1 S1 Gi 
Si Q1 Q1 


P2 Q2 R2 S2 T1 U2 V2 W2 X2 Y2 Z2 


Ls C2 T1 L1 
C2 H2 
I2 M:a Wi 
M1 01 


A1 02 St 
02 Gs 
Di W2 
Si 
Ei Si 
R1 
M1 Ri 
R1 


A2 Gi 
Gi 
Qi 
Qi 


(7) The coordinates of Rand A are identical and hence this letter occupies a cell along 
a diagonal sloping from left to right in the matrix. 


o. Since a row or a column can contain only 5 letters, it is obvious that A, D, E, M; B, H, N; 
and G, R, Q, S, fall in 3 different rows; C, O, M, W, Rand I, L, A, Q fall in different columns. A 
start may be made by an arbitrary placement of R in the position 1-1, and since Ri=02=C2= 
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~=W2, this means that R, 0, C, M, and W form one -column in the substitution checkerboard, as 
shown in :figure 9J)-A. The data also indicate that R, G, Q, and S must be in row 1, A, D, and E 


2'I component 
1 
2 
3 
4 
5 


1 R 
1----1- 
12~---1- 


~3 
g 
0 


:!.4 
M 


5 w 


H I 
X L 


FIGURE 95-A, 


GS 


x 


ADE 


must be in row 4, Hand X must be in column 3. This means that 01 for A, D, and E must be 4, 
and that 02 for Hand X must be 3. And since M1=I2=L2, 02 for I and L must be 4. 
Substitut- 


ing in the text the coordinates for the known values, additional plain-text words soon become 
evident. For example, taking the periods with the word HOSTILE, it becomes possible to insert 
p . d 
35 
.. ,,. ' 
36 
er10 ------------ 
·1 '1 
Plain text______ 
H 0 S T I ! j 


C 
f 


V1 V2 H1 H2 S1 S2 Ii ~ 
omponents ___ I2X1 X2 Si S2 L1 L2 ' 
Cipher text ____ V H S I X S L : 


LE 
Li L1 Wi W2 Xi X2 Li 
L:a Xi X2 R1 Ra Si S2 
LWXLXRS 


the letters Rp and Op as the second and fourth letters after Ep, suggesting that the word after 
HOSTILE is TROOP. 
This gives W1 X2=Tp, which permits of placing Tin position 5-3 .. Since Tin 


HOSTILE=S2 L11 therefore S2=5 and L1=3. Since Sis in row 1, and S2=5, S must go in position 
1-5. Since L.i=4 and L1=3, L must go in position 3-4. Since Op (the 1st 0 in TROOP)=X1R2 
and it is known that Op=3-1, therefore X must be in position 3-3. The checkerboard is now as 
shown in figure 95-B. From figure 94, X1=E2. 
Now X1=3, and since the E must be in row 4, 


~ 
~ 


12 34 5 
123 45 


1 
R 
s G 
1 
R 
s G 
- 
- 
- 
- 
- 
- 
2 c 
2 c 
- 
- 
- 
- 
- 
- 
01 
3 
0 
x L 
01 
3 
0 
x L 
- 
- 
- 
- 
- 
- 
4 
M 
ADE 
4 
M 
E 
AD 
- 
- 
- 
- 
- 
- 
- 
5 w 
T 
5 w 
T 


H 
I 
H 
I 


F1GUBR 96-B. 
F!GURRDll-Co 
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it is evident that E must· occupy cell 4-3, as seen in ·figure 95-C. There are now only 2 possible 
rows for H, either 1or2. It is deemed unnecessary to give further detail's of the process. Suffice 
it to say that in a few minutes the entire checkerboard is found to be as shown in figure 95-D. 
It will decipher the entire cryptogram as it stands, but speculating upon the presence of WU TV Z 
in the last row, and assuming a key-word mixed sequence has brought this about, a rearrange- 
ment of the columns of the checkerboard is made to give TU V W Z, as shown in figure 95-E. 
The arrangement of the rows now becomes quite evident and the original checkerboard is found 
to be as shown in figure 95-F. It seems to be based upon the key phrase XYLOPHONIC BEDLAM. 


1 
2 
3 
4 
5 


1 
R 
K 
G 
Q 
S 


2 
C 
N 
H 
I 
B 


013 
0 
Y 
X 
L 
P 


4 
M 
D 
E 
A 
F 


5 
W U 
T 
V 
Z 


FIGUBB 95-D. 


3 
2 
4 
1 
5 


1 
G 
K 
Q R 
S 


2 
H 
N 
I 
C 
B 


0 1 3 
X 
Y 
L 
0 
P 


4 
E 
D 
A 
M 
F 


5 
T 
U 
V 
W Z 


FIGUBB 96-E. 


1 
2 
3 
4 
5 


1 
X 
Y 
L 
0 
P 


2 
H 
N 
I 
C 
B 


0 1 3 
E 
D 
A 
M 
F 


4 
G 
K 
Q 
R 
S 


5 
T 
U 
V 
W Z 


FIGUBB 96-F. 


p. The completely deciphered cryptogram is as follows: 


1 
2 
3 


S I T U A T I 
0 N 0 N F R 0 
N T 0 F T W E 


4 
2 
5 
5 
3 
5 
2 
& 3 
1 
2 
3 
1 
3 
KZFBEIL 
7 
5 
THBRIGA 
& 2 
2 
4 
2 
4 
3 
1 
1 & ' 
3 
1 
3 


U C C E P Q L 


85 


9 
BATTA LI 
2 a a & a 1 
2 
& 3 
1 
1 
3 
3 
3 
IZEBELA 
. 63 


13 
YHASREA 
1 
2 
3 
4 
4 
3 
3 
2 
1 ·a a 4 1 a 


YMQDLWL 
91 


1 
2 
1 
2 
3 
4 
1 
4 
2 
' 
2 & ., 4 
YYMOCBR 
14 


6 
D E A S F 0 L 
3 
3 
3 
4 
3 
1 
1 
2 
1 
3 
5 
5 
4 
3 
AMEYLZQ 
42 


10 
ONFORTY 
1 
2 
3 
1 
' 
5 
1 
4 ·2 
5 4 4 1 2 


YESOBRY 
70 


14 


CHEDCRO 
2 2 a a 2 ' 
1 
4 
1 
1 
2 
4 
4 
4 
NACOXCR 


98 


2 
5 
1 
3 
5 & 3 
2 
1 
4 & 1 
4 
1 
B L Z D 0 T G 
21 
7 
L 0 W S C 0 L 
1 
1 a 4 
2 
1 
1 
3 
4 
4 
5 
' 
4 
3 
XWHLRWQ 


49 


11 


SEVENTH 
4 
3 
5 
3 
2 
5 
2 
& 1 
3 
1 
2 
1 
1 
QVBBLYX 
77 
15 


SSROADS 
4 
4 
4 
1 
3 
3 
4 


5 
5 
4 
4 
8 
2 
6 


RGASWQB 


105 


4 


NTYFOUR 
2 
5 
1 
3 
1 
5 
4 


2 
1 
2 
& 4 
2 
4 
BLPKYWC 
28 


8 


ONFIRST 
1 
2 
3 
2 
4 
4 
5 


' 
2 a a ' a 1 
YDRWBMT 


1111 


12 
INFANTR 
2 
2 
3 
3 
2 & ' 


3 
2 
5 
3 
2 
1 
' 
NABQBDO 


84 


16 


EVE NF IV 
3532325 
1 
3 
1 
2 & 3 
3 
FDDTEBA 
112 


17 
ESEVEND 
.3 
4 
3 
6 
3 .2 
3 
1 
5 
1 
3 
1 
2 
2 
M F D E T E N 
119 


21 
HREETHR 
·2 
4 
3 
3 
5 
2 
4 
1 
4 
1 
1 
1 
1 
4 
C A U G G X 0 


147 
25 


SSOUTHW 
4 
4 
1 
5 
5 
2 
5 
5 
5 
4 
2 
1 
1 
4 


RPUZWHO 


175 


29 


S I D E R A B 


4 
2 
3 
3 
4 
3 
2 
5 
3 
2 
1 
' 
3 
6 
KAQBDOF 


203 


33 
E R Y E F F 0 
3 
4 
I 
3 
3 
3 
1 


· l 
·4 
·2 
1 
6 
5 
4 
MLAXKPW 


231 
37 
$ .Q U T A N D 
' 
.1 
s a a 2 s 
& ' 
2 
1 
3 
2 
2 
GZDFKLN 


259 


41 


0 N S T 0 P M 
1 
2 
4 
5 
1 
1 
3 


4 
2 
& 1 
4 
5 
4 
YSXMBOW 


287 


45 
TYMA INT 
& 1 
3 
3 
2 
2 
2 
1 
2 
4 
3 
3 
2 
3 
T A N H C A I 
315 


179 


18 


DASHROA 
3 
3 
4 
2 
4 
1 
3 
23·51443 
A K G D F 0 Q 
126 
22 
E E G S T 0 P 
3344511 
1115145 
ART XX TS 
l/W 


26 
E S T 0 F C H 
3 
4 
5 
1 
3 
2 
2 
1 
5 
1 
4 
5 
4 
1 
MTDHTSG 
182 


30 


L E F 0 R C E 
1 
3 
3 
1 
4 
2 
8 
3154441 
LEKAPRG 
210 


34 
RTTODRI 
4551342 
4 
1 
1 
' 
2 
4 
3 


STMCXKQ 


238 
38 


0 C C U P Y D 
1 
2 
2 a 1 
1 a 


4 
4 
' 
2 
& 2 
2 
YBXMRBN 


266 
42 


Y T R 0 0 P S 
1 
& 4 
1 
1 
1 
4 


2 
1 
4 
4 
4 
5 
5 


PGXKORZ 
294 


46 
A I N I N G C 
3 
2 
2 
2 
2 
4 
2 
3 
3 
2 
3 
2 
1 
4 


D N C I D D 0 


322 


19 
D J U N C T I 
3 
2 
6 
2 
2 
5 
2 


2 
3 
2 
2 
4 
1 
3 


DUBNDCL 


133 
23 


ENEMYHO 
3 
2 
3 
3 
1 
2 
1 


I 
2 
1 
4 
2 
1 
4 
DAYXHKO 


161 
27 
A R L E S T 0 
3 
4 
1 
3 
4 
5 
1 
3 
4 
3 
1 
5 
1 
4 


M L S L Q P 0 


189 


31 


S T 0 P W I L 
4 
6 
1 
1 
5 
2 
1 


5 
1 
4 
6 
4 
3 
3 


SXUPOWA 


217 
35 


V E H 0 S T I 
5 
3 
2 
1 
4 
5 
2 


3 
1 
1 
4 
6 
1 
3 


V H S I X S L 


246 


39 


EFENSIV 
s a a 2 4 
2 a 


1 a 1 
2 & a a 
ADKTTBA 
273 
43 
HAVINGD 
2 s 
5 
2 
2 
4 
3 
1 
3 
3 
3 
2 
1 
2 


IUCEADY 
301 


47 


0 N N E C T I 
1 
2 
2 
3 
2 & 2 


4 
2 
2 
1 
4 
1 
3 
Y I B C N 0 L 
329 


20 
0 N F I V E T 
1 
2 a 2 .5 a a 
4 
2 
5 :3 
3 
1 ) 
YDVWBAX 
140 


24 


LDSWOOD 
1 
3 
4 
5 
1 
1 
3 
3 
2 
6 
4 
4 
4 
2 
LSXABRK 
168 
28 
W N I N C 0 N 
5 
2 
2 
2 
2 
1 
2 


4 
2 
3 
2 
4 
4 
2 


UNHCICK 
llltl 


32 


L. M A K E E V 
1 
3 
3 
4 
3 s 
6 


3 
4 
3 
2 
1 
1 
3 
LMAVQHL 


224 


36 


L E T R 0 0 P 


1 
3 
5 
' 
1 
1 
1 
3 
1 
1 
4 
4 
4 
6 
LWXLXRS 


2112 
40 


E P 0 S I T I 
a 1 
1 
' 
2 a 2 
1 a ' a a 1 a 
EOBHWVL 
280 


44 


I FF I C ·UL 
2 
3 
3 
2 
2 & 1 
3 
5 
5 
3 
' 
2 
3 
IDBLZMI 


BIB 


48 


ONWITHF 
1 
2 
5 
2 & 2 
8 


4 
2 4 3 
1 
1 & 
YUUMCEP 


336 


,:; . 


,Lr· 


11 i I 
·: : 
:) 
1 
ill'; 


'iJ 1, 
. ' 


!! :l 


; 


; ! 


i. 
.. 


'. l 


I 
~'. ! 


! ! 
~ 


: 
\ ~ 
ii 
I d! 
:: i , I 
! I 
;: I 
r· I 


; I/ 


: ,I I 


I j 
. ! 


i I 
!j 
I• 
. '' 
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.49 
50 
51 
52 


-b -R . T :y :F I .F 
T H I N F A .N 
TRYONNO 
R T H S ·T 0 P 


·:i ::, 
·~.15 
;1 
·.3 
2 
8 
·.15 
2 
2 
·.2 
3 
3 
2 
Ii 4 
I 
I 
2 
2 
.I 
' 
Ii 
2 ' 
5 
I 
1 
., 
4 
I 
·2 
5 
·3 
5 
l 
l 
3 
2 
5 
3 
2 
l 
4 
2 ' 


2 
2 
4 
4 
I 
l 
Ii 
I 
4 
5 
OTDMGBF 
UNAHLBD 
WX.NXKKC 
SCTOXTS 
343 
350 
357 
3114 


53 
54 
55 
56 


ENEMYNO 
NCOMMIS 
S I 0 N E D 0 
F F I C E R C 


3 
2 
3 
3 
l 
2 
l 
2 
2 
l 
3 
3 
2 
4 
4 
2 
l 
2 
3 
3 
1 
3 
3 
2 
2 
3 
4 
2 
I 
2 
I 
4 
2 
2 
4 
2 
4 
4 
4 
4 
3 
5 
5 
3 
4 
2 
I 
2 
4 
5 
5 
3 ' 


I 
4 
4 
DAYXHKC 
NLDKRRF 
KYAPMHC 
ANMBVGR 


371 
378 
385 
392 
57 
58 
59 
60 
APTURED 
NEARCHA 
RLESTOW 
NSTATES 


3 
I 
Ii 
5 
4 
3 
3 
2 
3 
3 
4 
2 
2 
3 
' 


I 
3 
4 
II 
I 
II 
2 
4 
5 
3 
5 
3 
4 
.. 
II 
I 
2 
4 
1 
2 
2 
I 
3 
4 
4 
I 
3 
' 


3 
l 
5 
l 
4 
4 
2 
5 
1 
8 
1 
1 
5 
E Z .Q A T C Y 
IMNDLRL 
GMT WE TR 
CVVKTEP 
399 
406 
413 
420 


61 
62 
63 
64 
THATENE 
MYS EVEN 
THDIVIS 
I ONISMO 
Ii 
2 
3 
5 
3 
2 
3 
3 
I ' 


8 
5 
8 
2 
II 
2 
3 
2 
5 
2 
4 
2 
1 
2 
2 
4 
3 
l 
1 
1 .3 
l 
1 
2 
l 
4 
2 
Ii 
I 
3 
I 
2 
I 
l 
2 
8 
3 
3 
II 
3 
4 
2 
3 
5 
4 
4 
UFDELXH 
EQVCBLY 
UDUGYAF 
HNQLKFR 


427 
434 
441 
448 


65 
66 
67 
68 


VINGINT 
0 A T T A C K 
POS"ITIO 
NSTONIG 
II 
2 
2 
4 
2 
2 
II 
1 
3 
II 
II 
3 
2 
4 
1 
I ' 


2 
.15 
2 
1 
2 
4 
II . t 
2 
2 
4 
3 
3 
2 
1 
3 
2 
1 
4 
3 
1 
1 
8 
4 
2 
5 
4 
II 
3 
1 
3 ' 


2 
5 
l 
4 
2 
3 
1 
UCNVDLH 
LZDRELK 
XKUPSEM 
CTNKTKE 
41111 
462 
469 
476 


69 
70 
71 
72 


HT-PREPA 
RATORYT 
OAT TACK 
ATDAYLI 


2 
Ii 
1 • 3 
1 a 
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3 
5 
I 
4 
1 
5 
I 
3 
.11 
II 
3 
2 
4 
3 
5 
3 
8 
1 
1 
2 
1 
1 
II 
4 
1 
15 
3 
4 
3 
1 
4 
4 
2 
I 
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3 
I 
I 
3 
4 
2 
3 
I 
2 
3 
2 a a 
B 0 E E P G V 
QTGWERH 
LZDRELK 
FAXIYDA 
483 
490 
497 
llM 


73 
74 
75 
GHTTOMO 
RROWMOR 
NIN G 


.4 
2 
II 
II 
1 
3 
1 
4 
4 
1 
II 
3 
1 
4 
2 
2 
2 
4 
I 
1 
l 
l 
4 
4 
4 
4 
4 
4 
4 
4 
4 
4 
2 
3 
3 
1 


KZLXXOR 
RPERRRR 
NC IE 


.1511 
518 
622 


!I.· The steps ta.ken in recovering the original substitution checkerboard demonstrate that 
cyclic permut~t~ons of a. correct checkerboard will serve to decipher such a. cryptogram just as 
well as the ongma.l checkerboard. In other words, a. cryptogram prepared according to this 
method is decipherable by factorial 5 (5X4X3X2Xl=120) checkerboards a.II of which a.re 
cyclica.lly equiva.lent. Even though the identities of the components will be different if the 
same message is enciphered by two different cyclica.lly-equiva.lent checkerboards, when these 
components a.re recombined, they will yield identical ciphel' texts, and therefore so far PS external 
appearances a.re concerned different checkerboards yield identica.l cryptograms. The reason 
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that there a.re only factorial 5 cyclically-equivalent checkerboards and not factorial 10, is that 
whatever permutation is applied to the row coordinates must be the same as that applied to the 
column coordinates in order that the aforesaid relationship hold true. If two checkerboards 
have identical row coordinates but different column coordinates certain portions of the crypto- 
graphic text will decipher correctly, others incorrectly. For this reason, in working with cryp- 
tograms of this type the cryptanalyst may successfully use a checkerboard which is incorrect in 
part and correct it as he progresses with the solution. It may also be added that the actual 
permutation of digits applied to the side and top of the checkerboard is of no consequence, so 
long as the permutations are identical. In other words, the permutation 5-2-1-3-4 will work 
just as well as 3-2-4-1-5, or 1-2-3-4-5, etc., so long as the same permutation is used for both 
row and column coordinates. It is the order of the rows and columns in the checkerboard 
which is the determining element in this system. Any arrangement (of the letters within the 
checkerboard) which retains the original order as regards the letters within rows and columns 
will work just as well as the original checkerboard. 
r. A final remark may be worth adding. 
After ell, the securhy of cryptograms enciphered 
by the bifid fractionating method rests upon the secrecy inherent in a 25-cell matrix containing 
a single mixed alphabet. In ordinary substitution, a single mixed alphabet hardly provides any 
security at all. Why does the bifid system, which also uses only a single mixed alphabet, yield 
so much higher a degree of security? Is it becouse of the transpositionel features involved·? 
Thinking about this point gives a negative answer, for after all, finding the length of the periods 
and replacing the cryptographic text by components based upon the cipher letters is a relatively 
easy matter. The transpositional features arc really insignificant. No, the answer to the 
question lies in a different direction and may be summed up about as follows. In solving a 
simple mixed-alphabet substitution cipher one can attack a few cipher letters (the ones of greatest 
frequency) and find their equivalents, yielding fragments of good plain text here and there in 
the cipher text. Once a few values have been established in this manner, say 6 values, the 
remaining 20 values can be found almost from the context alone. And in establishing these 6 
va.lues, the letters involved are not so interrelated that a.II 6 have to be ascertained simultane- 
ously. 
The cryptanalyst may establish the values one at a time. But in the case of the bifid system 
the equiva.lents of the plain-text letters are so interrelated that the cryptanalyst is forced to 
assume or establish the positions of several letters in the checkerboard simultaneously, not one 
by one. In other words, to use an analogy which may be only partially justified, the solution 
of a simple monoalphabetic substitution cipher is somewhat like forcing one's way into an inner 
chamber which has a number of doors each having a single lock; the solution of a bifid fraction- 
ated cipher is somewhat like getting into a va.ult--there is only one door which is provided with 
a. complex 5-combination lock and a.II the tumblers of the lock must be positioned correctly 
simultaneously before the releasing lever can drop into the slot and the door opened. Funda- 
mentally, this principle is responsible for the very much greater security of the bifid system as 
compared with that afforded by the simple monoalphabetic system. It is a principle well worth 
remembering and speculating upon. 


53. Special solutions for bifid systems.-a. The security of the bifid system is very con- 
siderably reduced if· the situation in which it is employed happens to be such that two or more 
messages with identical beginnings, endings, or internal portions can often be expected to occur. 
For in this case it is possible to establish equivalencies between components and quickly recon- 
struct the substitution checkerboard. 
An example will be given to illustrate the steps in a 


specific case. 
b. Here a.re two cryptograms transmitted by two coordinate units to a superior head- 
quarters at about the same time. They show certain identities, which have been underlined. 
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No. 1. ~BL ·!!NAB 
Q!m.QY 
HONDlL.!lJYTE 
M!:!QZ!L..QTLKE 
E.P{APK 
~LIP QDWC 
No. 2. VBNHY---XDABG 
BDOI!L_QBNWV 
LYTFW 
H9.XQQ. 
VLKEW 
WAXDQ__§ABCA 
NXGX 


c. Apparently these two cryptograms contain almost identical texts. In order to bring the 
identities into the form of superimposed components, it is necessary to transcribe the texts into 
periods of 7 and to superimpose the two messages as shown in figure 96. 


d. The shifting of the second cryptogram 2 intervals to the right brings about the superim- 
position of the majority of 0 1 and 02 components and it may be assumed that for the most part 
the texts are identical. Allowing for slight differences at the beginnings and ends of the two 
messages, suppose a table of equivalencies is drawn up, beginning with the eighth superimposed 


pairs. 
Thus,~=~:; hence N1=N2 and ~=01 • 
~:=~:;hence N2=H1 and B1=D2• Going through 


the text in this manner and terminating with the 42d superimposed pairs, the results are tabulated 
as shown in figure 97. 
e. From these equivalencies it is possible to reconstruct, if not the complete substitution 
matrix, then at least a portion of the matrix. For example, the data show that N, H, B, and I 
belong in the same row; E and F belong in the same row; N, D, U, Y, and K belong in the same 
column, and so on. Experimentation to make all the data fit one checkerboa.rd would sooner or 
later result in reconstructing the rheckerboard shown in figure 95-F, and the two messages read 
as follows: 
1. SEVENTH INFANTRY IN POSITION TO ATTACK AT FOUR AM PLAN FOUR. 
2. TENTH INFANTRY IN POSITION TO ATTACK AT FOUR AM PLAN THREEX. 


j. The foregoing gives a clue to what would happen in the case of an extensive traffic in 
which long phrases or entire sentences may be expected to occur repeatedly. By a proper 
indexing of all the material, identical sequences would be uncovered and these, attacked along 
the lines indicated, would soon result in reconstructing the checkerboard, whereupon all the 
messages may be read with ease. 


~4. Solution of tri:fid systems.-a. In the trifid fractionating system the cipher alphabet is 
tripartite in nature, that is, the plain-text letters are represented by permutations of 3 com- 
ponents taken in groups of 3's, thus forming a set of 27 equivalents, such as that shown below: 


A=lll 
B=112 
C=113 
0=121 
E=122 
F=123 
G=131 
H=132 
!=133 


J=211 
K=212 
L=213 
M=221 
N=222 
0=223 
P=231 
Q=232 
R=233 


5=311 
T=312 
U=313 
V=321 
W=322 
X=323 
Y=331 
Z=332 
?=333 


b. The equivalents may, of course, be arranged in a mixed order, and it is possible to use one 
tripartite alphabet for decomposition and a wholly different one for recomposition. One dis- 
advantage of such an alphabet is that it is a 27-element alphabet and therefore some subterfuge 
must be adopted as regards the 27th element, such as that illustrated in the footnote to paragraph 
57 of Special Text No. 166, Advanced Military Cryptography, wherein ZA stands for Zand ZB 
for the 27th character. 


1 
2 
3 
4 ·' 
II 
7 
I! 
9 
10 11 12 13 H 
1,, Ill 17 18 19 
:!() 21 
:122=12425262i28 
2ll 30 
:11 
:12 :ia 34 :t, 
31; 37 38 :iY 
411 
41 
42 
43 44 45 46 47 
4~ 4Y 


Qi ~ V1 V2 B1 B2 Bi 
N1 N2 Ai A2 Bi B2 Qi 
Y1 Y2 H1 H2 01 02 N1 
U1 U2 Y, Y2 T1 T2 Ei 
z, Z2 D1 D2 Ql Q2 T t 
Ei E2 W1 W2 Al A2 P1 
Lt L2 It I2 Pt P2 Qt 


B2 L1 L2 Yt Y2 X1 X2 
Q2 B1 B2 Dt D2 01 02 
N2 D1 D2 Wt W2 Vi V2 
E2 M1 M2 H1 H2 Qi Q2 
T2 L1 L2 Kt K2 Ei E2 
P2 K1 K2 Q1 Q2 Si S 
Q2 Di D2 Wi W2 C1 C2 
No. L_ _______ Q V B B L Y X 
N A B Q B D 0 
YHONDWV 
U Y T E M !!~ 
Z !LQ T L K E 
E LI P K fL§ 
L I P Q D W C 


V1 V2 Bi B2 Nt N2 Ht 
At A2 B1 B2 Gt G2 Bt 
Ht H2 01 02 B1 B2 N1 
Yt Y2 Tt T2 F1 F2 W1 
D1 D2 Qt Q2 Vi V2 Li 
W1 W2 At A2 X1 X2 Dt 
B1 B2 C1 C2 Ai A2 Ni 


H2 Y1 Y2 Xt X2 Dt D2 
B2 D1 D2 Ot 02 It I2 
N2 Wi W2 Vi V2 Lt L2 
W2 H1 H2 Qt Q2 X1 X2 
L2 Ki K2 E1 E2 Wt W2 
D2 Qi Q2 Si S2 At A2 
N2 Xt X2 G1 G2 Xt X2 


No. 2 _________ v B N H y x D 
A B G B D 0 I 
H 0 B N W V L 
Y T F W !LQ X 
!LQ V L K E W 
!'L..A X D .Q_§ A 
B C A N X G X 


FlllURE 00. 


81 82 • . • A1 Bt C1 Dt Et F1 Gi Hi I1 Kt Lt Mt Nl Ot P1 Qt Rt St Tt Ut V1 W1 Xt Y1 Zt 


~~ ~~~~··~~~· L~ 
~~~~~~~ 
~~ L~~ ~~~L~~ ~ 
~~ 


D1 Ni 
At 
Y2 Y2 
Dt U2 
L2 N2 
L2 
Nt N1 
A1 D2 
I2 Hi 
A2 
Bt Bt 
A2 Y2 
M1 K2 
Mt 
K2 K2 
I2 K2 
I1 
Ii H1 
It 
U2 
U2 U2 
Ht 


82 8i 
A2 B2 C2 D2 E2 F2 G2 H2 I2 K2 L2 M2 N2 02 P2 Q2 R2 S2 T2 U2 V2 W2 X2 Y2 Z2 


Ai U1 
Bt Lt Zt Yt 
D1 D2 Mt W2 Nt 
Wt Dt 
Xt Ni Ei M2 Ll B1 W1 
Q2 
Ni X2 
Q2 B1 Q2 Ki Ht 
Z2 I2 
Pt N2 Fi Kt E2 D2 P2 


D1 
Y2 
At Y2 D1 
I1 
Ai 
B1 
Nt 
L2 
N2 
L2 N1 A1 
B1 
L2 
o .. 
N2 
I2 
Hi 
A2 N2 A2 
U2 
A2 
H1 
U2 


M1 
K2 
Ml H1 I2 
D2 
Ml 
K2 
Hl 
It 
It 
K2 
11 
K2 


U2 
U2 
Y2 
Y2 
I1 


~·mt;llE 97. 
324155--41 
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c. The various types of fractionation possible in bifid systems are also adaptable in trifid 
systems. For example, using the alphabet shown above for recomposition as well as decom- 
position the encipherment of a message in periods of 7 is as follows: 


Plain tm:t _____________________ R E L I E F 0 
F y 0 URR E 
G I MENT T 
0 M ORR 0 w 


Components.---------------{ : 


1 
2. 
1 
1 
1. 
2 
1 
3 
2. 
3 
2 
2. 
1 
1 
1 
2. 
1 
2 
3. 
3 
2 
2 
2. 
2 
2 
2. 
3 
2. 
1 
3 
2. 
2 
2 
2 
3. 
2 
1 
3. 
3 
2 
3 
3. 
2 
2 
2. 
1 
1 
2 
2. 
2 
3 
3. 2 
2 
. 
3. 
2 
3 
3. 
2 
3 
3 
3. 
1 
3 
3. 
3 
3 
2 
1. 
3 
1 
2. 
2 
2 
2 
3. 
1 
3 
3. 
3 
3 
2 


Cipher text ___________________ K A QH 0 RR H W FL x I z B F ? NA T N NN WR 0 I z 


CRYPTOGRAM 
KAQHO RRHWF LXIZA BFZBN ATNNN WROIZ 


d. The solution of a single cryptogram of this nature would be a quite difficult matter, espe- 


cially if there were nothing upon which to make assumptions for probable words. But a whole 
series of cryptograms could be solved, following in general the procedure outlined in the case of 
the bifid system, although the solution is, a.dmittedly, much more complicated. The first step 
is to ascertain the length of the period, nnd when this has been done, transcribe the cipher text 
into components, which in their vertical combinations then represent monoalphabetic equiva- 
lents, with, of course, many variants for each letter of the plain text. Then a study is made to 
establish component equivalents, just as in the bifid system. If the text is replete with repeti- 
tions, or if a long word or a short phrase may be assumed to be present, a start may be made and 
once this sort of entering wedge has been forced into the structure, its further disintegration and 
ultimate complete demolition is only a matter of time and patience. 
55. Concluding remarks on fractionating systems.-a. It goes without saying that the 
basic principles of fractionation in the bifid and trifid systems are susceptible to a great deal of 
variation and complication. For example, instead of having periods of fixed length through the 
message it is possible to vary the length of the periods according to some simple or complex key 
suitable for this purpose. Or the bifid and trifid systems may be combined into a single scheme, 
enciphering a. text by the bifid method and then reenciphering the cipher text by the trifid 
method and so on. Systems of this sort may become so complex as to defy analysis, especially 
if the keys are constantly and frequently varied so that no great a.mount of traffic accumulates 
in any single key. Fortunately for the cryptanalyst, however, such complex systems as these, if 
introduced into actual usage, are attended by so many difficulties in practice that the enemy 
cryptographic service would certainly break down and it would not be long before requests for 
repetition, the transmission of the same cryptogram in different keys, and so on, would afford 
clues to solution. Could such systems be employed successfully in field service there is no doubt 
that from the standpoint of security, the cryptograms would be theoretically secure. But the 
danger of error and the slowness with which they could be operated by the usual cryptographic 
clerks are such that systems of this complexity can hardly be employed in the field, and therefore 
the cryptanalyst may not expect to encounter them. 
b. However, the simple bifid system, the ADFGVX system, and the like, are indeed practicable 
for field use, have been used with success in the past, and may be expected to be in use in the 
future. It is therefore advisable that the student become thoroughly familiar with the basic 
principles of their solution and practice the application of these principles as frequently as p.os- 
sible. In this connection, the attention of the student is directed to the fact that there is theo- 
retically no reason why the bipartite components of the ADFGVX system cannot be recombined 
by means of the same or a different checkerboard, thus reducing the cryptographic text to a form 
wherein i~ consists of 25 different letters, and at the same time cutting the length of the messages 
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in half. The matter is purely one of practicability: it adds one more step to the process; But it 
must not be overlooked that this additional step would add a good deal of strength to the system, 
for it would shorten, mask, distort, or entirely eliminate similar beginnings and similar endings--- 
the two most fruitful sources of attack on this system. 


56. Concluding remarks on transposition systems.-a. Simple transposition systems hardly 
afford any security at all; complex ones may in the case of individual or single messages afford a 
high degree of security. But just as soon as many cryptograms in the same key are transmitted 
the chances of finding two or more cryptograms of identical length become quite good and the 
general solution may be applied. 
b. Contrary to the situation in the case of substitution, in that of transposition wherein the 
letters of the plain-text itself are transposed (not code) the shorter the cryptogram the greater the 
possibility of solution. For, in the case of a message of say only 25 or 30 letters,· one might shift 
the letters about and actually reconstruct the plain text as one does in the case of the game called 
"anagrams." Of course, several different "solutions" may thus be obtained, but having such 
"solutions" it may be possible to reconstruct the system upon which the transposition was based 
and thus "prove" one of the solutions. 
c. The text has confined itself almost entirely to cases of uniliteral transposition, in order to 
demonstrate basic principles. But there is inherently no reason why transposition may not be 
applied to digraphs, trigraphs, or tetragraphs. If longer sequences are used as the units of 
transposition the security decreuses very sharply, as in the case of the ordinary route ciphers of 
the Civil War period. 
d. Transposition designs, diagrams, or patterns are susceptible of yielding cryptograms of 
good security, if they are at all irregular or provide for nulls and blank spaces. Such devices are 
particularly difficult to solve if frequently changed. 
e. Transpositions effected upon fixed-length sequences of plain text yield a low degree of 
security but when a transposition is applied to the cipher text resulting from a good substitution 
system or to the code text of cryptograms first encoded by means of an extensive code book the 
increase in the cryptographic security of such cryptograms is quite notable. In fact, transposi- 
tion methods and designs are frequently used to "superencipher" substitution text or code and 
play a very important role in this field. Their great disadvantage is that inherent in all trans- 
position methods: The addition or deletion of a single letter or two often makes the entire 
cryptogram unreadable even with the correct key. 
j. The clues afforded by messages with similar beginnings, endings, or internal portions, 
and by repetitions of incorrectly enciphered messages without paraphrasing the original text 
are often sufficient to make a solution possible or to facilitate a solution. For this reason the 
cryptanalyst should note all cases wherein clues of this sort m~ be applicable and be prepared 
to take full advantage of them. 


• 


• 


SECTION XI 
ANALYTICAL KEY 


Paragraph 


Analytical keY---------------------------------------------------------------------------------------------------··------------------- 
57 


57. Analytical key.-Continuing the scheme initiated in the first text of this series the 
analytical key applicable to the subject matter and systems embraced in this text is ~ven 
below. 
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